CVE-2026-78069: CWE-862 Missing Authorisation in j2commerce.com J2Store extension for Joomla

The J2Store extension for Joomla contains a missing authorization vulnerability (CWE-862) in the `J2StoreControllerApps` component's `appTask` delegation path. This path instantiates app-plugin controllers without performing any access control checks, relying instead on a side-effect 403 response from a wildcard-deny ACL rule that lacks explicit allow rules. This allows unauthorized users to trigger actions intended to be restricted. Furthermore, the `applocalizationdata::getInstallerTool()` method uses a caller-influenced table name without an allow-list to select and truncate database tables and build paths to SQL files that it executes, enabling path traversal and arbitrary file read/execute capabilities. The affected versions are 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6 of the J2Store extension. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

This vulnerability allows unauthorized users to bypass intended access controls in the J2Store extension, potentially leading to unauthorized execution of app-plugin controller actions. The caller-influenced table name and path traversal in the installer tool further increase the risk by enabling unauthorized database truncation and arbitrary file read and execution. The overall impact is critical, as indicated by the CVSS 4.0 score of 9.5, reflecting high confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected J2Store controller functionalities if possible. Monitor official j2commerce.com and Joomla security advisories for updates and apply patches promptly once available.