Executive brief
J2Store is a Joomla-based e-commerce extension that manages shopping carts and orders. An unauthenticated attacker can create or modify cart records belonging to any user by exploiting a missing access control check in the generic FOF framework's save task. This could allow an attacker to inject items into victims' carts, modify prices, or escalate to unauthorized purchases.
Technical details
The vulnerability is an authorization bypass in the J2Store cart controller (J2StoreControllerCarts). The `fof.xml` configuration grants a wildcard ACL permission to all cart view tasks, and the Framework-on-Framework (FOF) library only enforces CSRF tokens on back-end HTML requests, not on front-end `format=raw` requests. While the extension properly scoped the `remove()` task to the caller's own session, it failed to override the generic FOF `save` task, leaving it reachable from the front-end. An attacker can invoke this task with attacker-controlled `user_id` and `session_id` parameters to insert new cart rows or overwrite existing ones. No authentication is required; the vulnerability is reachable via network requests.
Affected products
- j2commerce.com J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
Timeline
- 2026-09-03: disclosed: Vulnerability published on NVD