CVE-2026-78065 j2commerce.com CVE debrief

Who should care

Joomla site administrators, J2Store users, and security teams responsible for patching and monitoring should be aware of this vulnerability. They should verify affected versions, restrict address management access, and monitor for suspicious activity. Additionally, operators of e-commerce platforms using J2Store, security teams managing Joomla deployments, and vulnerability management teams should review and update their systems accordingly.

Technical summary

The J2Store extension for Joomla has an IDOR vulnerability allowing authenticated users to access guest-checkout address information; verify and restrict address management access. This vulnerability exists in J2Store versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6. The issue arises from the `editAddress()` function redirecting non-owners away only when the loaded address row had a non-empty `user_id` belonging to someone else. Guest-checkout address rows have an empty `user_id`, so that check never triggered for them.

Defensive priority

Authenticated users may access sensitive guest-checkout address information; verify and restrict address management access.

Recommended defensive actions

• Verify and restrict access to address management functionality
• Review and update J2Store versions to ensure patching
• Monitor for suspicious address access attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record indicates an IDOR vulnerability in J2Store versions 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6; verify affected versions and user access controls. This vulnerability allows authenticated users to access guest-checkout address information. Defenders should verify address management access controls, review user roles, and ensure proper patching of affected J2Store versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.