CVE-2026-78069: Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403 only as a side effect of fof.xml's wildcard-deny resolving under the singularised ACL key app, which has no explicit allow rule — not because of any deliberate check. Behind that path, applocalizationdata::getInstallerTool() used a caller-influenced table name with no allow-list, both to select a #j2store table for truncation and to build a path to SQL files it then executes — a path-traversal-capable file read/execute.
Affected Software
Event History
Frequently Asked Questions
Is the observed 403 response a deliberate authorization control?
No. The 403 currently occurs because the wildcard-deny in fof.xml resolves under the singularized ACL key "app," which has no explicit allow rule. The delegation chain itself contains no ACL check.
Could a configuration change make the affected path reachable?
Yes. The current denial depends on the wildcard-deny behavior and the absence of an explicit allow rule for the "app" ACL key. It is not enforced by an authorization check in the controller delegation path.
What should be checked to determine whether a deployment is in scope?
Check the installed J2Store version against the affected ranges: 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6. Also review the fof.xml ACL configuration, particularly how the singularized "app" key resolves.