CVE-2026-67360 is an authorization bypass vulnerability (CWE-639) in the J2Store extension for Joomla. It affects versions 1.0.0 through 3.3.20, 4.0.0 through 4.0.20, and 4.1.0 through 4.1.5. The flaw allows an authenticated user to supply another customer's order_id and copy that customer's cart contents and address data into their own session. The vulnerability occurs because the system validates the CSRF token but does not check whether the authenticated user owns the order_id being accessed, leading to cross-customer order replication.

An attacker with authentication can access and replicate another customer's order details, including cart contents and address data. This could lead to unauthorized disclosure of sensitive customer information and potential privacy violations. The vulnerability does not allow privilege escalation or remote unauthenticated access but compromises data confidentiality between customers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions where possible and monitor for suspicious activity involving order_id manipulation. Vendors or maintainers should implement proper ownership checks on order_id parameters to prevent unauthorized access.