CVE-2026-67359 describes an authorization bypass vulnerability in the J2Store extension for Joomla. The flaw allows unauthenticated visitors to manipulate the order_id query parameter to view the complete checkout confirmation page of any order. This results in unauthorized disclosure of order content including line items, pricing, and totals. The affected versions are 1.0.0 through 3.3.20, 4.0.0 through 4.0.20, and 4.1.0 through 4.1.5. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. No official remediation or patch information is currently provided, and no known exploits in the wild have been reported.

The vulnerability allows unauthorized disclosure of sensitive order information to unauthenticated users. This can lead to privacy violations and potential exposure of customer purchase details. There is no indication of privilege escalation or system compromise beyond information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to order confirmation pages or implement additional access controls to verify user authorization before displaying order details.