Security
Cotton Cloud fixes two Joomla access control flaws
Two medium-severity access control vulnerabilities in the Cotton Cloud file-storage extension for Joomla have been fixed in version 2.0.3, according to mySites.guru.
The affected release was 2.0.1. CVE-2026-67283 covered missing authentication, allowing unauthenticated visitors to reach front-end tasks when only a CSRF token was checked. It carried a CVSS 4.0 score of 6.9 and was fixed in 2.0.2.
CVE-2026-67284 involved broken authorisation and insecure direct object references (IDOR) in database access by numeric file and folder IDs. A logged-in user could access or alter another user’s data. It was rated medium severity with a CVSS 4.0 score of 5.3.
mySites.guru said it reproduced the remaining issue in 2.0.2, where an ownership check had been added to a method that the package did not call. The developer corrected the authorisation path in 2.0.3, including checks around the model, terminal and MCP interfaces.
Administrators should update Cotton Cloud to 2.0.3. The advisory says to treat 2.0.2 and earlier releases as vulnerable.
Originally reported by mySites.guru.