CVE-2026-67360: J2Store Auth Bypass Vulnerability

CVE-2026-67360 Overview

CVE-2026-67360 is an Insecure Direct Object Reference (IDOR) vulnerability in the J2Store extension for Joomla, developed by J2Commerce. An authenticated user can supply another customer's order_id to copy that customer's cart contents and address data into their own session. The application validates the Cross-Site Request Forgery (CSRF) token but does not verify that the requesting user owns the referenced order. The flaw is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated attackers can replicate another customer's cart and address information cross-account, leading to exposure of personally identifiable information (PII) stored in J2Store orders.

Affected Products

J2Store for Joomla versions 1.0.0 through 3.3.20
J2Store for Joomla versions 4.0.0 through 4.0.20
J2Store for Joomla versions 4.1.0 through 4.1.5

Discovery Timeline

2026-08-21 - CVE-2026-67360 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-67360

Vulnerability Analysis

The vulnerability exists in the order-copy workflow of J2Store, a commerce extension for Joomla. When an authenticated user reuses a prior order to repopulate their cart, the application accepts an order_id parameter from the request. The server-side handler enforces CSRF token validation on the request but omits an ownership check that ties the submitted order_id to the currently authenticated user.

As a result, any authenticated customer can substitute an arbitrary order_id belonging to another customer. The application then copies that order's cart line items and address data into the attacker's active session. The attacker gains visibility into product selections, quantities, billing details, and shipping addresses stored on the victim's order record.

The issue is a business-logic authorization failure. Impact is limited to confidentiality of order-related data; the flaw does not directly enable modification of the victim's order or financial fraud against the merchant's payment pipeline.

Root Cause

The root cause is a missing authorization check on a user-controlled identifier. The handler treats a valid CSRF token as sufficient proof to act on the referenced order_id. It does not compare the order's stored customer_id (or equivalent owner reference) against the session's authenticated user before duplicating the order data.

Attack Vector

Exploitation requires an authenticated Joomla storefront account and knowledge or enumeration of a target order_id. Order identifiers in J2Store are typically sequential, so an attacker can iterate values to harvest data from many customers. The request is delivered over the network via the storefront's normal HTTP interface, and no user interaction from the victim is required.

No verified proof-of-concept code is published for CVE-2026-67360. Refer to the J2Commerce official website for vendor-supplied technical details.

Detection Methods for CVE-2026-67360

Indicators of Compromise

Repeated POST or GET requests to J2Store cart or checkout endpoints with sequentially varying order_id parameter values from a single authenticated session.
Session activity in which the loaded cart, billing address, or shipping address does not match the authenticated user's historical order data.
Application or web server logs showing a single Joomla user account referencing order_id values that were never created by that account.

Detection Strategies

Enable verbose access logging on the Joomla web server and retain query strings and POST bodies for J2Store checkout routes to allow retrospective analysis of order_id usage.
Correlate authenticated session identifiers with the ownership metadata of the referenced order_id in the J2Store database, and alert when the two do not match.
Baseline the normal rate of cart-replication actions per account, and flag accounts that trigger this workflow at a rate consistent with enumeration.

Monitoring Recommendations

Monitor Joomla and J2Store database queries for SELECT operations against the orders table where the requesting session user differs from the record's owner.
Alert on high-volume, low-interval requests targeting cart-restore or reorder endpoints from a single account or IP address.
Track outbound response sizes on the affected endpoints to detect bulk data exfiltration through repeated cross-customer order copies.

How to Mitigate CVE-2026-67360

Immediate Actions Required

Inventory all Joomla installations and confirm whether the J2Store extension is installed and which version is deployed.
Upgrade J2Store to a version released after 3.3.20, 4.0.20, or 4.1.5 as published by J2Commerce; consult the J2Commerce official website for the current fixed release.
Review recent Joomla and J2Store logs for evidence of cross-customer order_id access and notify affected customers if PII exposure is confirmed.

Patch Information

J2Commerce is the maintainer of J2Store. Administrators should apply the vendor-supplied update that adds an ownership check binding the order_id parameter to the authenticated customer prior to copying order data. Verify patch availability and version guidance directly on the J2Commerce official website.

Workarounds

Restrict access to the storefront's reorder or cart-copy functionality behind a web application firewall (WAF) rule that blocks or challenges rapid iteration of the order_id parameter.
Temporarily disable the reorder or "copy previous order" feature in J2Store configuration until the patched version is deployed.
Rotate order identifiers to non-sequential, unpredictable values (for example, UUIDs) to reduce the effectiveness of enumeration while the underlying authorization gap remains unpatched.

bash

# Example WAF rule concept (ModSecurity) to block sequential order_id enumeration
# Adjust paths and thresholds to match the deployed J2Store storefront
SecRule REQUEST_URI "@contains /index.php?option=com_j2store" \
    "id:1002026,phase:2,deny,status:403,\
    chain,msg:'J2Store order_id enumeration attempt (CVE-2026-67360)'"
    SecRule ARGS:order_id "@rx ^[0-9]+$" \
        "chain"
        SecRule IP:ORDER_ID_COUNT "@gt 20" \
            "setvar:ip.order_id_count=+1,expirevar:ip.order_id_count=60"