CVE-2026-78081: J2Store for Joomla CSRF Vulnerability

CVE-2026-78081 Overview

CVE-2026-78081 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the J2Store extension for Joomla, published by j2commerce.com. The flaw stems from missing CSRF protection on the cart, checkout, and myprofile controllers. Affected versions include J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7. A forged request riding a victim's active checkout session can silently overwrite billing or shipping addresses before order confirmation, or tamper with a saved profile address through the saveAddress() function.

Critical Impact
An attacker can redirect a paid order's goods to an attacker-controlled address by silently overwriting shipping details during an active checkout session.

Affected Products

J2Store 1.0.0 through 3.3.2
J2Store 4.0.0 through 4.0.22
J2Store 4.1.0 through 4.1.7

Discovery Timeline

2026-09-15 - CVE-2026-78081 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-78081

Vulnerability Analysis

J2Store is a shopping cart extension for the Joomla content management system. The affected controllers handle sensitive state-changing operations including cart updates, checkout processing, and user profile modifications. None of these controllers validate an anti-CSRF token before accepting state-changing requests.

An attacker crafts a malicious page or link that submits a forged HTTP request to a victim's Joomla site running J2Store. When the victim visits the attacker page while authenticated with an active session, the browser automatically attaches session cookies. The server accepts the forged request as legitimate and executes the operation with the victim's own privileges.

The most impactful sub-case targets the checkout flow. A forged request overwrites the billing or shipping address after payment authorization but before final order confirmation, redirecting physical goods to an attacker-controlled destination. Each forged request runs with only the victim's own session privileges, so there is no cross-account data access.

Root Cause

The root cause is the absence of anti-CSRF token validation on state-changing endpoints in the cart, checkout, and myprofile controllers. Joomla provides a built-in token mechanism, but the affected controllers do not enforce it on the vulnerable action handlers, including saveAddress().

Attack Vector

Exploitation requires a victim with an active J2Store session to interact with attacker-controlled content, such as a malicious link or a page hosting a hidden auto-submitting form. The forged request targets the vulnerable controller endpoints over the network. See the J2 Commerce site for extension details.

Detection Methods for CVE-2026-78081

Indicators of Compromise

Unexpected address changes on orders where the shipping address differs from the customer's stored profile or historical purchase pattern.
HTTP POST or GET requests to cart, checkout, or myprofile controllers with Referer headers pointing to unrelated third-party domains.
Multiple saveAddress() invocations on a single user profile within a short window, particularly during active checkout sessions.

Detection Strategies

Enable web server access logging and parse for state-changing requests to J2Store controllers that lack a valid Referer or Origin header matching the site domain.
Correlate order-address mutations with the timestamps of user session activity to spot address overwrites that occur without corresponding user-driven page navigation.
Deploy web application firewall (WAF) rules that flag or block cross-origin POST requests to J2Store checkout and profile endpoints.

Monitoring Recommendations

Alert on customer support tickets or chargebacks referencing shipments delivered to unrecognized addresses.
Monitor J2Store audit logs for changes to saved profile addresses that are not followed by user-driven navigation events.
Track checkout sessions where the shipping address is modified after payment authorization but before order finalization.

How to Mitigate CVE-2026-78081

Immediate Actions Required

Upgrade J2Store to a fixed release beyond 3.3.2, 4.0.22, and 4.1.7 as published by j2commerce.com.
Audit recent orders for address mismatches between billing, shipping, and stored profile addresses, and hold suspicious shipments pending customer confirmation.
Force reauthentication and invalidate long-lived sessions for storefront users to limit exposure of active checkout sessions.

Patch Information

Refer to j2commerce.com for the vendor-published fixed version of J2Store. Apply the update through the Joomla Extensions Manager and verify the installed version after upgrade.

Workarounds

Enforce SameSite=Lax or SameSite=Strict on session cookies to block cross-site cookie attachment on forged requests.
Deploy a WAF rule requiring a same-origin Origin or Referer header on POST requests to J2Store cart, checkout, and myprofile endpoints.
Instruct storefront users to log out after completing purchases and to avoid browsing untrusted sites during active checkout.

bash

# Example WAF rule (ModSecurity) enforcing same-origin on J2Store state-changing endpoints
SecRule REQUEST_URI "@rx /index\.php\?option=com_j2store&(view|task)=(cart|checkout|myprofile)" \
  "id:1002026,phase:1,deny,status:403,\
   chain,msg:'CVE-2026-78081 CSRF protection'"
  SecRule REQUEST_HEADERS:Origin "!@beginsWith https://your-site.example" \
    "chain"
    SecRule REQUEST_METHOD "@streq POST"