CVE-2026-102775: CWE-639: Authorization Bypass Through User-Controlled Key in phoca.cz Phoca Cart extension for Joomla

The Phoca Cart extension for Joomla contains an authorization bypass vulnerability (CWE-639) in its order-file download endpoint. The parameters 'd' (download token) and 'o' (order token) are only checked for non-emptiness and are never validated against the actual stored tokens. This allows an attacker to bypass authorization controls and access digital goods belonging to other customers by enumerating sequential order IDs and submitting arbitrary non-empty tokens. The vulnerability affects versions 5.0.0 through 6.1.8 of Phoca Cart.

An attacker can remotely download any customer's digital goods without authentication or valid tokens, leading to unauthorized access and potential theft of digital products. This compromises the confidentiality and integrity of customer orders and digital assets managed by the Phoca Cart extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the order-file download endpoint where possible and monitor for suspicious activity related to order ID enumeration. Avoid exposing this functionality publicly if feasible.