Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-21626 Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure https://www.cve.org/CVERecord?id=CVE-2026-21626
Post summary
A newly disclosed CVE (2026-21626) involves improper access control for forum post custom fields in JSON output, leading to potential information disclosure.
🚨 CVE-2026-21626: Extension - http://stackideas.com - Inf... ACL bypass in EasyDiscuss JSON endpoints leaks custom field data with zero authentication - trivial to weaponize for ma... https://zerodaysignal.com/vulnerability/CVE-2026-21626 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE-2026-21626, describing an ACL bypass in EasyDiscuss that leaks custom field data without authentication and is trivially weaponizable. No PoC, exploit code, patch, or active exploitation details are included.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | stackideas | easydiscuss | - | joomla\! | - |