Quick answers
- Is CVE-2026-82190 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82190 being exploited in the wild.
- How severe is CVE-2026-82190?
- Informational severity, with a CVSS score of 0, published 15 September 2026.
- Which products and versions are affected?
- J2Commerce J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7.
- Is there a fix for CVE-2026-82190?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82190 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-82190?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a cryptographic weakness in the order access token generation mechanism. J2Store uses a predictable/forgeable token scheme that depends on the Joomla site's secret key; an attacker who possesses this secret can compute valid tokens for arbitrary orders without authentication. The attack requires prior knowledge of the site's Joomla secret (obtained through a separate vulnerability vector), giving it high attack complexity. Successful exploitation grants guest access to sensitive order data and digital downloads. The token is never refreshed, meaning the exposure cannot be remediated by patching the secret-disclosure vector alone—the Joomla secret itself must be rotated.
Affected products
- J2Commerce J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Timeline
- 2026-09-15: disclosed