CVE-2026-78081: Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A forged request riding a victim's active checkout session could silently overwrite the billing or shipping address before order confirmation — the most consequential sub-case, since it opens the door to redirecting a paid order's goods to an attacker-controlled address — or tamper with a saved profile address via saveAddress(). As before, each forged request executes with only the victim's own session privileges, so there is no cross-account data access.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed for an attacker to redirect an order to another address?
The victim must have an active checkout session, and the forged request must overwrite the billing or shipping address before order confirmation. The request executes using that victim's existing session.
Does this issue provide cross-account access?
No. Forged requests run only with the victim's own session privileges and do not provide cross-account data access.