CVE-2026-67362 is an open redirect vulnerability in the J2Store extension for Joomla. Specifically, in versions 1.0.0 through 3.3.20, 4.0.0 through 4.0.20, and 4.1.0 through 4.1.5, four task handlers in the cart controller accept a base64-encoded URL from user input and redirect to it without validating the destination host. This lack of validation enables attackers to redirect users to untrusted sites, facilitating phishing attacks that leverage the shop's trusted domain. The vulnerability requires no authentication and has a CVSS 4.0 base score of 5.1, indicating medium severity.

An attacker can exploit this vulnerability to redirect users from the legitimate shop domain to malicious external sites. This can be used to conduct phishing attacks by leveraging the trust users place in the shop's domain. There is no requirement for authentication, increasing the attack surface. However, the vulnerability does not directly compromise the system or data but facilitates social engineering attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or filtering on URLs used for redirection to ensure they only point to trusted destinations. Monitoring for suspicious redirect usage may also help mitigate phishing risks.