Executive brief
J2Store is a popular e-commerce extension for Joomla that handles online shopping and order processing. A vulnerability in guest checkout allows any authenticated user to view customer address information—including full names, street addresses, and phone numbers—by sequentially guessing address IDs. This can expose sensitive personal data from guest checkout customers, potentially leading to privacy violations and reputational harm.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the `editAddress()` function. The vulnerable code checks whether a logged-in user owns an address by validating that the `user_id` field is non-empty and belongs to a different user; however, guest-checkout address records have a null or empty `user_id`, so this ownership check is never triggered. Any authenticated user can access the address edit form by guessing or incrementing the `address_id` parameter, causing the guest customer's personal information to be prefilled into the form. No special privileges or user interaction required beyond Joomla account login. Affected versions are J2Store 1.0.0–3.3.21 and 4.0.0–4.1.6; a patch should implement proper access control on all address records regardless of `user_id` state.
Affected products
- j2commerce.com J2Store 1.0.0-3.3.21, 4.0.0-4.1.6
Timeline
- 2026-09-03: disclosed