CVE-2026-67358: J2Store Auth Bypass Vulnerability

CVE-2026-67358 Overview

CVE-2026-67358 affects the J2Store extension for Joomla, developed by j2commerce.com. The vulnerability allows an authenticated user holding a valid order token to increment the download limit counter on a download record that belongs to a different order. The affected endpoint also lacks a Cross-Site Request Forgery (CSRF) token, expanding the attack surface. The flaw is categorized under [CWE-352] Cross-Site Request Forgery and constitutes a business logic and access control weakness in J2Store's download quota handling.

Critical Impact
Authenticated users can manipulate download quotas on records belonging to other orders, causing denial of legitimate downloads and integrity loss on order-associated resources.

Affected Products

J2Store for Joomla versions 1.0.0 through 3.3.20
J2Store for Joomla versions 4.0.0 through 4.0.20
J2Store for Joomla versions 4.1.0 through 4.1.5

Discovery Timeline

2026-08-21 - CVE-2026-67358 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-67358

Vulnerability Analysis

J2Store implements a download quota system that tracks how many times a purchaser has retrieved a downloadable product tied to an order. Each download record is bound to an order, and the download counter enforces a maximum quota. The vulnerable endpoint accepts a valid order token from any authenticated user and increments the download counter on download records without verifying that the token owner actually owns the targeted download record. The endpoint additionally omits a CSRF token, so a request can be triggered from an attacker-controlled page while a victim is authenticated to the store.

The result is a cross-tenant integrity issue within the store: an attacker can push another customer's counter past the allowed threshold and lock that customer out of legitimate downloads. There is no confidentiality impact because file contents are not disclosed, and availability of the wider application is not affected.

Root Cause

The root cause is missing authorization enforcement on the download counter endpoint combined with the absence of CSRF protection. The handler validates that a submitted order token is well-formed but does not check that the token's associated order owns the download record being modified. This is a classic broken access control and missing CSRF token pattern mapped to [CWE-352].

Attack Vector

An attacker authenticates to a Joomla site running a vulnerable J2Store version and obtains a valid order token from any order they legitimately hold. The attacker then issues a request to the download counter endpoint referencing a download record identifier that belongs to a different order. Because CSRF protection is absent, the same action can be delivered by luring an authenticated customer to visit an attacker-controlled page that submits the request on their behalf.

Code examples are not published for this issue. See the J2Commerce Security Overview for vendor guidance.

Detection Methods for CVE-2026-67358

Indicators of Compromise

Repeated POST requests to J2Store download counter endpoints from a single authenticated session referencing multiple, unrelated download record identifiers.
Download counters that increment on order records without a corresponding file download event in web server access logs.
Customer support reports of downloads being denied with quota-exceeded errors on orders that were never fully redeemed.

Detection Strategies

Correlate Joomla session identifiers with the order identifiers touched by download counter requests and alert when a session modifies records outside its owned orders.
Inspect HTTP request logs for J2Store download endpoints that are invoked without a referer header matching the store's own domain, indicating potential CSRF delivery.
Baseline the ratio of counter-increment events to actual file transfer bytes served, and flag statistical deviations.

Monitoring Recommendations

Enable verbose application logging in J2Store to capture the acting user, submitted order token, and targeted download record for every counter update.
Forward Joomla and web server logs to a centralized analytics platform and retain them long enough to reconstruct multi-step abuse across sessions.
Monitor customer service ticket queues for clusters of quota-related complaints tied to the same product or timeframe.

How to Mitigate CVE-2026-67358

Immediate Actions Required

Upgrade J2Store to a fixed release above 4.1.5, or the vendor-designated patched version for the 3.x and 4.0.x branches, as published on the vendor site.
Audit recent download counter activity for orders that report exhausted quotas without matching file transfer records and reset counters for affected customers.
Rotate order tokens for active customers if the platform supports token regeneration.

Patch Information

Upgrade to a J2Store release that enforces ownership checks on the download counter endpoint and adds a CSRF token to the request. Refer to the J2Commerce Security Overview for the current fixed versions and release notes.

Workarounds

Restrict access to J2Store download endpoints behind a web application firewall rule that requires a same-origin referer and a valid anti-CSRF token.
Temporarily disable the affected download endpoint for anonymous or low-trust customer groups until the patch is applied.
Increase download quota headroom or disable strict quota enforcement to reduce customer impact while remediation is scheduled.

bash

# Example WAF rule concept enforcing same-origin referer on the J2Store download endpoint
# ModSecurity pseudo-rule
SecRule REQUEST_URI "@contains index.php?option=com_j2store" \
  "chain,deny,status:403,id:1026673580,msg:'J2Store download endpoint cross-origin request blocked'"
  SecRule &REQUEST_HEADERS:Referer "@eq 0"