CVE-2026-78065: CWE-639 (Authorization Bypass Through User-Controlled Key) in j2commerce.com J2Store extension for Joomla

The vulnerability in J2Store extension for Joomla arises from the editAddress() function's access control logic, which only redirects non-owners when the address record's user_id is non-empty and belongs to another user. Guest checkout addresses have an empty user_id, so this check fails to prevent access. Consequently, any logged-in user can guess small, sequential address_id values to retrieve guest customers' personal address details prefilled in the edit form. This issue affects versions 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6 of the J2Store extension.

Unauthorized disclosure of guest checkout customers' personal address information, including full name, street address, and phone number, to any authenticated user. This compromises user privacy and may facilitate further attacks or fraud. There is no indication of privilege escalation or remote code execution. The vulnerability has a CVSS 4.0 base score of 7.1 (high severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated user accounts and monitor for suspicious activity related to address_id enumeration. Avoid exposing sequential identifiers or implement additional access control checks to verify ownership of address records, including those with empty user_id fields.