Access control settings for forum post custom fields are not enforced when the EasyDiscuss extension outputs data as JSON. This omission allows an attacker to retrieve sensitive custom field information that should be restricted, resulting in unauthorized exposure of potentially private or confidential data.

The vulnerability affects the Stackideas EasyDiscuss extension for Joomla, specifically versions 1.0.0 through 5.0.15. Any Joomla site that has this extension installed and exposes the JSON output for post custom fields is susceptible.

The CVSS score of 9.2 indicates a severe impact, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers could exploit it by sending unauthenticated HTTP requests to the JSON endpoint, bypassing ACL checks and obtaining the data. The high severity combined with the low current exploitation likelihood still presents a high risk if the vulnerable version remains in use.