CVE-2026-78065: Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - editAddress() redirected non-owners away only when the loaded address row had a non-empty userid belonging to someone else. Guest-checkout address rows have an empty userid, so that check never triggered for them — any logged-in account guessing a small, sequential addressid got a guest customer's full name, street address, and phone number rendered prefilled into the edit form.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated J2Store account can exploit it. The attacker must be able to submit or guess a guest-checkout address_id; sequential, small IDs make enumeration practical.
What data can be exposed?
The affected edit form can reveal a guest customer's full name, street address, and phone number.
Are guest checkout records specifically affected?
Yes. The authorization check only redirected non-owners when the address record had a non-empty user_id belonging to another user; guest-checkout records have an empty user_id, so that check did not apply.
Which releases are affected?
Affected ranges are J2Store 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6.