CVE-2026-67362 J2Store CVE debrief

Who should care

Joomla site administrators, J2Store users, cybersecurity teams responsible for web application security, and organizations using J2Store for e-commerce functionality should be aware of this vulnerability. They should assess their exposure, apply mitigations, and monitor for suspicious activity. Security teams should prioritize patching or mitigating this vulnerability to prevent potential phishing attacks using the shop's trusted domain.

Technical summary

The J2Store extension for Joomla has an open redirect vulnerability in versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5. Four task handlers accept a base64-encoded URL from user input and redirect to it without validating the destination host, potentially enabling phishing attacks using the shop's trusted domain. No authentication is required to exploit this vulnerability. The vulnerability allows attackers to redirect users to malicious sites, potentially leading to phishing attacks.

Defensive priority

Medium priority given the CVSS score of 5.1 and the potential for phishing attacks using the shop's trusted domain.

Recommended defensive actions

• Inventory and version checks for J2Store installations
• Implementing compensating controls to validate redirect URLs
• Monitoring for suspicious redirect activity
• Applying vendor remediation when available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record indicates that four task handlers in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication is required. Evidence is limited to CVE and NVD details. Defenders should verify J2Store installations, review redirect handling, and monitor for suspicious activity.

Official resources