CVE-2026-78064: Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF save task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - fof.xml grants the carts view's tasks a wildcard true ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end format=raw requests. J2StoreControllerCarts already scoped remove() to the caller's own session, but never overrode the generic FOF save task, so it remained reachable to insert new cart rows with an attacker-chosen userid/sessionid, or overwrite an existing row by id.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
J2Store (j2commerce.com)to a version that resolves this vulnerability.Fixed in 1.0.0-3.3.21 - Upgrade
Upgrade
J2Store (j2commerce.com)to a version that resolves this vulnerability.Fixed in 4.0.0-4.0.21 - Upgrade
Upgrade
J2Store (j2commerce.com)to a version that resolves this vulnerability.Fixed in 4.1.0-4.1.6
Event History
Frequently Asked Questions
Does exploitation require an authenticated Joomla or J2Store account?
No. The affected save task is reachable through front-end requests using format=raw, where FOF does not enforce CSRF tokens for this path.
Is a custom ACL configuration required for the issue to be reachable?
No custom ACL change is described. The bundled fof.xml grants a wildcard true ACL to tasks in the carts view.
What can an attacker change through the exposed task?
An attacker can create cart records with an attacker-chosen user_id and session_id, or overwrite an existing cart record when its ID is known. The controller's session scoping applied to remove(), but not to the inherited save task.