CVE-2026-67359: J2Store Information Disclosure Vulnerability

CVE-2026-67359 Overview

CVE-2026-67359 is an authorization bypass in the J2Store extension for Joomla, developed by j2commerce.com. The flaw allows unauthenticated attackers to view arbitrary order confirmation pages by supplying an order_id value as a query parameter. Exposed data includes line items, prices, and order totals from other customers' checkouts. The vulnerability is categorized under [CWE-639] Authorization Bypass Through User-Controlled Key, commonly known as Insecure Direct Object Reference (IDOR). Affected releases include J2Store versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5.

Critical Impact
Unauthenticated attackers can enumerate order identifiers and disclose the full checkout confirmation page for any order, exposing customer purchase details across the storefront.

Affected Products

J2Store for Joomla 1.0.0 through 3.3.20
J2Store for Joomla 4.0.0 through 4.0.20
J2Store for Joomla 4.1.0 through 4.1.5

Discovery Timeline

2026-08-21 - CVE-2026-67359 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-67359

Vulnerability Analysis

J2Store renders the checkout confirmation view based on an order_id value passed through the request. The confirmation controller does not verify that the requesting session owns the referenced order, nor does it require authentication. An attacker submits a numeric order_id and receives the rendered confirmation page, including item names, quantities, unit prices, discounts, taxes, and totals. Because order_id values are sequential integers in typical Joomla and J2Store deployments, an attacker can iterate through the identifier range to harvest data across the entire order history of a storefront.

Root Cause

The extension relies on possession of an order_id as an implicit authorization token, without binding the identifier to an authenticated session or a per-order secret. This is a textbook Insecure Direct Object Reference weakness tracked as [CWE-639]. The confirmation endpoint treats any incoming identifier as authoritative and skips ownership and session checks before rendering order contents.

Attack Vector

Exploitation requires only network access to the storefront. No authentication, user interaction, or elevated privileges are needed. An attacker crafts a request to the J2Store confirmation URL and sets the order_id query parameter to a target value. Scripted enumeration allows bulk extraction of order data. The vulnerability does not permit modification of orders, only disclosure of their contents.

No verified public exploit code is available. See the J2Commerce homepage for vendor references.

Detection Methods for CVE-2026-67359

Indicators of Compromise

Sequential or high-volume GET requests to the J2Store checkout confirmation route with varying order_id values from a single client IP address.
Unauthenticated sessions accessing order confirmation pages that do not correspond to any prior checkout activity from the same session.
Web server logs containing bursts of 200 OK responses to confirmation URLs referencing order_id values outside the typical distribution.

Detection Strategies

Parse Joomla and web server access logs for enumeration patterns targeting the J2Store confirmation endpoint, focusing on rapid increments of the order_id parameter.
Correlate anonymous or unauthenticated user agents accessing multiple distinct order_id values within short time windows.
Compare accessed order identifiers against the session's authenticated customer to identify cross-account access attempts.

Monitoring Recommendations

Enable verbose logging on the Joomla site and forward access logs to a centralized platform for query and alerting.
Establish a baseline for legitimate confirmation-page request rates and alert on deviations.
Review payment processor reconciliation reports for evidence of order data reuse in downstream fraud.

How to Mitigate CVE-2026-67359

Immediate Actions Required

Upgrade J2Store to a release later than 4.1.5 that includes the vendor's authorization fix, per guidance published on the J2Commerce homepage.
Audit web server and Joomla logs for prior unauthorized access to the confirmation endpoint and notify affected customers where required by regulation.
Restrict access to the J2Store confirmation route through a web application firewall rule until the patch is applied.

Patch Information

The vendor identifies affected ranges as J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5. Administrators should install the fixed release supplied by j2commerce.com and verify the version through the Joomla extension manager after upgrade.

Workarounds

Deploy a WAF rule that blocks unauthenticated requests to the J2Store confirmation URL when no matching session cookie is present.
Require Joomla user login before the confirmation view renders by restricting the menu item to registered users, if the storefront configuration permits.
Rotate order identifier schemes to use unpredictable tokens where the extension supports custom order references.

bash

# Example WAF rule (ModSecurity) blocking unauthenticated access to J2Store confirmation
SecRule REQUEST_URI "@contains index.php?option=com_j2store&view=checkout&task=confirm" \
  "id:2026673590,phase:1,deny,status:403,\
   chain,msg:'Block unauthenticated J2Store order confirmation access'"
  SecRule &REQUEST_COOKIES:/joomla_user_state/ "@eq 0"