# CVE-2026-78064: J2Store anonymous cart tampering via FOF save task

Source: https://junglewise.ai/threats/cve-2026-78064-j2store-anonymous-cart-tampering-via-fof-save-task  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78064 · Severity: info · CVSS 7.5 · Published 2026-09-03

J2Store is a Joomla-based e-commerce extension that manages shopping carts and orders. An unauthenticated attacker can create or modify cart records belonging to any user by exploiting a missing access control check in the generic FOF framework's save task. This could allow an attacker to inject items into victims' carts, modify prices, or escalate to unauthorized purchases.

Technologies: [J2commerce.Com J2Store](https://junglewise.ai/threats/technologies/j2store). Vendors: [J2commerce.Com](https://junglewise.ai/threats/vendors/j2commerce-com).

## Quick answers

**Is CVE-2026-78064 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78064 being exploited in the wild.

**How severe is CVE-2026-78064?** Informational severity, with a CVSS score of 7.5, published 3 September 2026.

**Which products and versions are affected?** J2commerce.Com J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6.

**Is there a fix for CVE-2026-78064?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78064 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-78064?** Check whether you run J2commerce.Com J2Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in the J2Store cart controller (J2StoreControllerCarts). The `fof.xml` configuration grants a wildcard ACL permission to all cart view tasks, and the Framework-on-Framework (FOF) library only enforces CSRF tokens on back-end HTML requests, not on front-end `format=raw` requests. While the extension properly scoped the `remove()` task to the caller's own session, it failed to override the generic FOF `save` task, leaving it reachable from the front-end. An attacker can invoke this task with attacker-controlled `user_id` and `session_id` parameters to insert new cart rows or overwrite existing ones. No authentication is required; the vulnerability is reachable via network requests.

## Affected products

- j2commerce.com J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

## Timeline

- 2026-09-03: disclosed: Vulnerability published on NVD

## References

- [https://www.j2commerce.com/](https://www.j2commerce.com/)

## Related threats

- [J2Store PayPal parameter injection in redirect](https://junglewise.ai/threats/cve-2026-82191-j2store-paypal-parameter-injection-in-redirect)
- [J2Store order status manipulation via unauthenticated request](https://junglewise.ai/threats/cve-2026-82189-j2store-order-status-manipulation-via-unauthenticated-request)
- [J2Store SQL injection in storefront product list](https://junglewise.ai/threats/cve-2026-81567-j2store-sql-injection-in-storefront-product-list)
- [J2Commerce J2Store missing CSRF protection in checkout controllers](https://junglewise.ai/threats/cve-2026-78081-j2commerce-j2store-missing-csrf-protection-in-checkout)
- [J2Store missing authorization in Apps controller](https://junglewise.ai/threats/cve-2026-78069-j2store-missing-authorization-in-apps-controller)