Joomla J2Store: Four Vulnerabilities Including Critical Auth Bypass Disclosed Together
Four vulnerabilities, ranging from Critical to Medium, were disclosed in Joomla's J2Store extension, impacting authorization, data integrity, and payment processing.
Key findings
- Four vulnerabilities disclosed in Joomla's J2Store extension on September 3, 2026.
- Vulnerabilities include missing authorization, cart tampering, XSS, and PayPal callback forgery.
- Affects J2Store versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6.
- Impacts range from unauthorized access to order confirmation fraud and phishing.
- Patches are available; users advised to update immediately.
On September 3, 2026, a batch of four vulnerabilities was disclosed in the J2Store extension for Joomla, developed by j2commerce.com. These vulnerabilities, ranging in severity from Medium to Critical, impact multiple versions of the extension and could allow for unauthorized access, data tampering, phishing attacks, and order confirmation fraud.
The vulnerabilities stem from flaws in authorization checks, input validation, and payment processing logic within the J2Store extension.
One critical vulnerability, CVE-2026-78069, involves missing authorization checks in the J2StoreControllerApps's appTask delegation chain. This allows for the instantiation of app-plugin controllers without proper Access Control List (ACL) verification, potentially leading to unauthorized actions.
A high-severity flaw, CVE-2026-78064, permits anonymous cart record tampering. This is due to an overly permissive ACL setting for the 'carts' view's tasks and a lack of CSRF token enforcement on front-end requests formatted as raw. This allows unauthenticated users to modify cart data.
Another high-severity issue, CVE-2026-77999, concerns unauthenticated PayPal callback forgery. The PayPal Instant Payment Notification (IPN) listener's signature validation was flawed, accepting unverified or non-invalid responses as valid. This could be exploited to confirm fraudulent orders.
A medium-severity vulnerability, CVE-2026-78000, is a reflected Cross-Site Scripting (XSS) flaw. It affects task handlers that accept base64-encoded URLs via parameters like filter_tag, pricefrom, and priceto. Without proper validation of the destination host, attackers can craft malicious links that redirect users to phishing sites, leveraging the trusted domain of the shop.
These vulnerabilities affect J2Store versions 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6. Users are strongly advised to update to the latest available versions to mitigate these risks. The disclosure of these vulnerabilities highlights the importance of rigorous security auditing for e-commerce extensions, especially concerning authorization, input sanitization, and payment gateway integrations.
The coordinated disclosure of these four vulnerabilities underscores the need for Joomla site administrators to maintain up-to-date e-commerce extensions. Prompt patching is essential to prevent potential financial loss and reputational damage stemming from compromised customer data and fraudulent transactions. Patches are available for all affected versions.