# CVE-2026-102775: Phoca Cart authorization bypass in order-file download endpoint

Source: https://junglewise.ai/threats/cve-2026-102775-joomla-extension-phoca-cz-authorisation-bypass-through-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-102775 · Severity: info · Published 2026-10-05

Phoca Cart is a Joomla e-commerce extension that manages digital product sales and downloads. An attacker can download any customer's digital goods without authorization by exploiting weak token validation in the order download endpoint. By simply enumerating order IDs and providing arbitrary non-empty tokens, an unauthorized user—including unauthenticated guests—can access any customer's purchased digital files, exposing sensitive product content and customer purchases.

Technologies: [Phoca.cz Phoca Cart](https://junglewise.ai/threats/technologies/phoca-cart). Vendors: [Phoca.cz](https://junglewise.ai/threats/vendors/phoca-cz).

## Quick answers

**Is CVE-2026-102775 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102775 being exploited in the wild.

**How severe is CVE-2026-102775?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** Phoca.cz Phoca Cart 5.0.0 through 6.1.8.

**Is there a fix for CVE-2026-102775?** Yes: fixed in Phoca Cart 6.1.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102775 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-102775?** Check whether you run Phoca.cz Phoca Cart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Phoca Cart 6.1.9

## Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) combined with insufficient token validation in Phoca Cart's order-file download endpoint. The download (d) and order (o) token parameters are only checked for non-emptiness but are never validated against the stored download_token and order_token values. An unauthenticated attacker can sequentially enumerate order IDs and supply arbitrary non-empty tokens to download any customer's digital goods, bypassing authorization controls entirely.

## Affected products

- phoca.cz Phoca Cart 5.0.0 through 6.1.8

## Timeline

- 2026-10-05: disclosed

## References

- [https://www.phoca.cz/](https://www.phoca.cz/)

## Related threats

- [Phoca Cart reflected XSS in price filter parameters](https://junglewise.ai/threats/cve-2026-76565-phoca-cart-reflected-xss-in-price-filter-parameters)
- [Phoca Cart stored XSS in User-Agent header processing](https://junglewise.ai/threats/cve-2026-76564-phoca-cart-stored-xss-in-user-agent-header-processing)