CVE-2026-78064: CWE-639 (Authorization Bypass Through User-Controlled Key) in j2commerce.com J2Store extension for Joomla

The vulnerability in J2Store extension for Joomla (CVE-2026-78064) is due to improper authorization controls on the 'save' task of the carts view. The 'fof.xml' grants broad ACL permissions, and CSRF protections are not enforced on front-end raw requests. While the 'remove' function is scoped to the caller's session, the generic FOF 'save' task is not overridden, allowing attackers to create or overwrite cart entries with arbitrary user_id or session_id values. This constitutes an authorization bypass through a user-controlled key, classified under CWE-639.

An attacker can anonymously manipulate cart records by inserting new entries or overwriting existing ones with attacker-chosen user or session identifiers. This could lead to unauthorized data manipulation within the e-commerce cart system, potentially affecting order integrity or user data consistency. The CVSS 4.0 score of 8.8 indicates a high impact with network attack vector, no privileges or user interaction required, and high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, restricting access to the affected tasks or disabling front-end raw format requests for the carts view may reduce exposure, but such measures should be validated against operational requirements.