CVE-2026-67284
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The Joomla extension Cotton Cloud before version 2.0.3 has improper ACL implementation, allowing authenticated users to perform file operations (read, delete, overwrite, re-assign permissions) on files owned by other users.
Risk Assessment
Authenticated users can gain unauthorized access to other users' files, compromising data confidentiality and integrity, and potentially leading to privilege escalation.
Recommendation
Update the Cotton Cloud extension to version 2.0.3 or later to fix the ACL issue.
Original NVD description (English source)
Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.3 - Authenticated users could perform various file-related operations (read, delete, overwrite, re-assign permissions) on files owned by other users.