CVE-2026-78064 j2commerce.com CVE debrief

Who should care

Administrators and users of J2Store versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 should be aware of this vulnerability and take necessary actions to patch or mitigate it. This includes reviewing and applying patches, verifying FOF configuration and ACL settings, and monitoring for suspicious cart activity. Security teams should prioritize vulnerability management for affected deployments and track exceptions during remediation efforts.

Technical summary

The J2Store extension for Joomla is vulnerable to anonymous cart-record tampering due to an inherited FOF `save` task in versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6. The `fof.xml` file grants the `carts` view's tasks a wildcard `true` ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end `format=raw` requests. This allows attackers to insert new cart rows with an attacker-chosen `user_id`/`session_id`, or overwrite an existing row by id. Affected administrators should prioritize patching to prevent potential cart-record tampering.

Defensive priority

Organizations using J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 should prioritize patching to prevent potential cart-record tampering.

Recommended defensive actions

• Review and apply patches for J2Store versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6
• Verify FOF configuration and ACL settings
• Monitor for suspicious cart activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record indicates a HIGH severity vulnerability with a CVSS score of 8.8. The vulnerability affects J2Store versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6, allowing for anonymous cart-record tampering via inherited FOF `save` task. Evidence is limited to CVE and NVD details. Defenders should verify J2Store versions, review FOF configuration, and monitor for suspicious cart activity. Additional verification is recommended due to potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.