CVE-2026-82190: Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla secret can compute a valid access token for any order on the site without ever having placed one, gaining guest access to that order's details and any purchased digital downloads. Because the token is never rotated, this exposure persists indefinitely even after the underlying secret-disclosure vector is patched, unless the Joomla secret itself is also rotated. The attack complexity (AC:H) is high because it depends on the secret already being known through a separate vector; it is not directly exploitable by an anonymous visitor with no other foothold.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Rotate the Joomla site `secret` because the exposure persists indefinitely even after the underlying secret-disclosure vector is patched, unless the Joomla secret itself is also rotated.
Event History
Frequently Asked Questions
Who is exposed to unauthorized order access?
Sites running the affected J2Store version ranges are exposed if their Joomla secret has been obtained through a separate disclosure vector. An attacker with that secret can access details and purchased digital downloads for any order, including orders they did not place.
What does an attacker need to exploit this issue?
The attacker must already know the site's Joomla secret. The issue is not directly exploitable by an anonymous visitor who has no other foothold or secret-disclosure path.
What should be done if the Joomla secret may have been exposed?
Rotate the Joomla secret. Patching only the vector through which the secret was disclosed is insufficient, because previously forgeable order tokens remain valid indefinitely unless the Joomla secret is also rotated.