J2Store / J2Commerce (com_j2store) 3.3.21 (Joomla 3 branch) - Unauthenticated Payment Callback Forgery and Cart Tampering, Backend Privilege Escalation, Guest Address IDOR and Reflected XSS (5 CVEs)

J2Store / J2Commerce

Affected versions: ≥ 3.3.21 and < 3.3.22

Full advisory: our disclosure post · www.j2commerce.com

J2Store / J2Commerce - J2Store / J2Commerce (com_j2store) 4.0.21 (Joomla 4.0 branch) - Unauthenticated Payment Callback Forgery and Cart Tampering, Backend Privilege Escalation, Guest Address IDOR and Reflected XSS (5 CVEs)

J2Store / J2Commerce 4.0.21 is affected by five vulnerabilities in com_j2store, disclosed by Phil Taylor (mySites.guru) and fixed by J2Commerce on 31 August 2026. CVE-2026-78069 (CVSS 9.5, Critical): the administrator Apps controller instantiates app-plugin controllers through an appTask delegation path with no com_j2store ACL check anywhere in the code, and the backend node of fof.xml declares no view ACL at all, so FOF defaults an unmatched task to allow rather than deny. Any authenticated Joomla backend user, holding no J2Store permission whatsoever, can trigger #__j2store_* table truncation and traversal-based SQL file execution; only the Joomla core administrator login wall keeps anonymous visitors out, and that checks nothing about com_j2store permissions. CVE-2026-78064 (CVSS 8.8, High): the carts view inherits the generic FOF save task under a wildcard true ACL in fof.xml, and FOF enforces CSRF tokens only on backend HTML requests, not on frontend format=raw requests, so an unauthenticated POST can insert cart rows with an attacker-chosen user_id or session_id, or overwrite an existing row by id. CVE-2026-77999 (CVSS 8.7, High): the PayPal IPN listener treated UNVERIFIED and any non-INVALID response as valid, made its verification request with CURLOPT_SSL_VERIFYPEER disabled, and stored the verdict in a field nothing downstream read, so processing continued regardless of the outcome; separately, omitting mc_gross from the POST body skipped the paid-amount comparison entirely. Unauthenticated requests could confirm orders that were never paid for, or fail legitimate ones. CVE-2026-78065 (CVSS 7.1, High): editAddress() redirected non-owners away only when the loaded address row had a non-empty user_id, and guest checkout rows have none, so any logged-in account guessing a small sequential address_id was shown a guest customer full name, street address and phone number prefilled into the edit form. CVE-2026-78000 (CVSS 5.3, Medium): filter_tag, pricefrom and priceto are echoed unescaped into a hidden input value attribute by J2Html::input(), across all six shipped product-tags templates, giving reflected XSS from a crafted link with no click beyond the initial navigation. FIX: update to 4.0.22 on this 4.0.x branch (the equivalent fixes are 3.3.22 on the Joomla 3 branch and 4.1.7 on 4.1.x). If you cannot update immediately: disable PayPal, or watch pending orders for CONFIRMED or FAILED transitions with no matching PayPal transaction; disable guest checkout; and review every Joomla backend account regardless of privilege level, because the Apps controller issue needs a backend login but no J2Store permission. All five CVE records were published by the Joomla CNA on 3 September 2026 and all five credit Phil Taylor, mySites.guru. The affected ranges are unchanged. Four scores match the vendor advisory; CVE-2026-78069 was raised from the vendor's 9.4 to 9.5 Critical, and the published vector reads AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, scoring the backend login as an attack requirement (AT:P) rather than a privilege (PR:L).

Affected versions: ≥ 4.0.21 and < 4.0.22

Full advisory: our disclosure post · www.j2commerce.com

J2Store / J2Commerce - J2Store / J2Commerce (com_j2store) 4.1.6 (Joomla 4.1 branch) - Unauthenticated Payment Callback Forgery and Cart Tampering, Backend Privilege Escalation, Guest Address IDOR and Reflected XSS (5 CVEs)

J2Store / J2Commerce 4.1.6 is affected by five vulnerabilities in com_j2store, disclosed by Phil Taylor (mySites.guru) and fixed by J2Commerce on 31 August 2026. CVE-2026-78069 (CVSS 9.5, Critical): the administrator Apps controller instantiates app-plugin controllers through an appTask delegation path with no com_j2store ACL check anywhere in the code, and the backend node of fof.xml declares no view ACL at all, so FOF defaults an unmatched task to allow rather than deny. Any authenticated Joomla backend user, holding no J2Store permission whatsoever, can trigger #__j2store_* table truncation and traversal-based SQL file execution; only the Joomla core administrator login wall keeps anonymous visitors out, and that checks nothing about com_j2store permissions. CVE-2026-78064 (CVSS 8.8, High): the carts view inherits the generic FOF save task under a wildcard true ACL in fof.xml, and FOF enforces CSRF tokens only on backend HTML requests, not on frontend format=raw requests, so an unauthenticated POST can insert cart rows with an attacker-chosen user_id or session_id, or overwrite an existing row by id. CVE-2026-77999 (CVSS 8.7, High): the PayPal IPN listener treated UNVERIFIED and any non-INVALID response as valid, made its verification request with CURLOPT_SSL_VERIFYPEER disabled, and stored the verdict in a field nothing downstream read, so processing continued regardless of the outcome; separately, omitting mc_gross from the POST body skipped the paid-amount comparison entirely. Unauthenticated requests could confirm orders that were never paid for, or fail legitimate ones. CVE-2026-78065 (CVSS 7.1, High): editAddress() redirected non-owners away only when the loaded address row had a non-empty user_id, and guest checkout rows have none, so any logged-in account guessing a small sequential address_id was shown a guest customer full name, street address and phone number prefilled into the edit form. CVE-2026-78000 (CVSS 5.3, Medium): filter_tag, pricefrom and priceto are echoed unescaped into a hidden input value attribute by J2Html::input(), across all six shipped product-tags templates, giving reflected XSS from a crafted link with no click beyond the initial navigation. FIX: update to 4.1.7 on this 4.1.x branch (the equivalent fixes are 3.3.22 on the Joomla 3 branch and 4.0.22 on 4.0.x). If you cannot update immediately: disable PayPal, or watch pending orders for CONFIRMED or FAILED transitions with no matching PayPal transaction; disable guest checkout; and review every Joomla backend account regardless of privilege level, because the Apps controller issue needs a backend login but no J2Store permission. All five CVE records were published by the Joomla CNA on 3 September 2026 and all five credit Phil Taylor, mySites.guru. The affected ranges are unchanged. Four scores match the vendor advisory; CVE-2026-78069 was raised from the vendor's 9.4 to 9.5 Critical, and the published vector reads AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, scoring the backend login as an attack requirement (AT:P) rather than a privilege (PR:L).

Affected versions: ≥ 4.1.6 and < 4.1.7

Full advisory: our disclosure post · www.j2commerce.com