This ACL bypass in a third-party Joomla extension demonstrates a failure mode that security teams should recognize across CMS ecosystems: ownership implemented as metadata for display rather than as an enforced access gate. The vulnerability allows any authenticated user to read, delete, overwrite, and re-assign permissions on files they don't own — a complete breakdown of resource isolation that the CVSS 5.3 rating badly understates. In practice, most CMS installations allow trivial account creation, so the 'authenticated user' requirement means nearly nothing.
The root cause isn't that developers ignored security — it's that ownership was likely added during a security sprint, the field appeared in the schema, and then subsequent operations were built or extended without revisiting whether each one needed to consult the owner check. This is 'layered amnesia': the database remembers the column, but the codebase forgets its purpose. Every file operation added afterward became the path of least resistance because writing if ($current_user->id !== $file->owner_id) { deny(); } requires deliberate effort while absence of that check is the default.
For defenders: verify that every file operation in your CMS extension stack actually consults the owner_id field — don't assume because a schema has an owner column that it's enforced everywhere. The blast radius extends beyond this specific extension: if ownership is decorative in four operations, audit what other operations on that object model are missing checks. Treat CVSS 5.3 on extension vulnerabilities as a signal to look harder, not a signal that the issue can wait.