CVE-2026-102775: Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8
Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored downloadtoken / ordertoken values. As a result, any remote user (including a guest with no account at all) can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote user can exploit it, including an unauthenticated guest with no account. The attacker only needs access to the order-file download endpoint.
What does an attacker need to provide to download another customer's digital goods?
The attacker can enumerate sequential order or file ID values and provide arbitrary non-empty values for the d (download token) and o (order token) parameters. The endpoint does not compare those supplied values with the stored download_token or order_token values.
Which Phoca Cart versions are affected?
Phoca Cart versions 5.0.0 through 6.1.8 are affected.
How can I determine whether my deployment is vulnerable?
Check whether the installed Phoca Cart version falls between 5.0.0 and 6.1.8. The vulnerable behavior is present when the order-file download endpoint accepts non-empty d and o parameters without validating them against the corresponding stored tokens.