CVE-2026-78065 PUBLISHED

Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

Assigner: Joomla
Reserved: 22.08.2026 Published: 03.09.2026 Updated: 03.09.2026

Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - editAddress() redirected non-owners away only when the loaded address row had a non-empty user_id belonging to someone else. Guest-checkout address rows have an empty user_id, so that check never triggered for them — any logged-in account guessing a small, sequential address_id got a guest customer's full name, street address, and phone number rendered prefilled into the edit form.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 7.1

Product Status

Vendor j2commerce.com
Product J2Store extension for Joomla
Versions Default: unaffected
  • Version 1.0.0-3.3.21 is affected
  • Version 4.0.0-4.0.21 is affected
  • Version 4.1.0-4.1.6 is affected

Credits

  • Phil Taylor, mysites.guru finder

References

Problem Types

  • CWE-639 (Authorization Bypass Through User-Controlled Key) CWE