CVE-2026-82190 describes a predictable and forgeable order access token vulnerability in the J2Store extension for Joomla versions 1.0.0 through 3.3.22, 4.0.0 through 4.0.22, and 4.1.0 through 4.1.7. An attacker who has obtained the Joomla site's secret can compute valid access tokens for any order, gaining unauthorized guest access to order details and digital downloads. The token is never rotated, so the vulnerability remains until the Joomla secret itself is rotated. The attack requires prior knowledge of the secret, which is not directly obtainable through this vulnerability alone.

An attacker with knowledge of the Joomla site secret can access any order's details and purchased digital downloads without authorization. This compromises confidentiality of order information and digital content. The vulnerability persists indefinitely because the access token is never rotated, even after patching the initial secret disclosure vector, unless the Joomla secret is rotated. However, the attack complexity is high since the attacker must already have the Joomla secret from another source.

No official patch links are provided for this vulnerability. Because the access token is never rotated, remediation requires rotating the Joomla site secret to invalidate existing tokens. Additionally, any separate vulnerability that led to disclosure of the Joomla secret must be patched to prevent further secret leakage. Monitor vendor advisories for any official fixes or updates. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.