CVE-2026-78064

J2Store, an e-commerce extension for Joomla from j2commerce.com, inherits the generic FOF framework 'save' task on its carts controller without overriding it, while its fof.xml grants the carts view's tasks a wildcard 'true' ACL and FOF only enforces CSRF tokens on back-end HTML requests rather than front-end format=raw requests. As a result, an unauthenticated remote attacker can call the save task against the front-end carts controller to insert new cart rows with an attacker-chosen user_id/session_id or overwrite an existing cart row by id; the extension had scoped remove() to the caller's own session but never applied the same restriction to save. Successful abuse allows tampering with other visitors' cart records — injecting or overwriting cart contents ahead of checkout — which drives the high (8.8) CVSS 4.0 score with high integrity impact and no privileges or user interaction required. Any Joomla site running J2Store 1.0.0–3.3.21, 4.0.0–4.0.21, or 4.1.0–4.1.6 is affected. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.2%, so no exploitation is currently known.

What to do: Upgrade J2Store to a patched release later than the affected ranges in each branch — later than 3.3.21 on the 3.x line, 4.0.21 on the 4.0.x line, and 4.1.6 on the 4.1.x line. Because the flaw allows overwriting rows by id, administrators should inspect the J2Store cart records in the database for unexpected rows or rows with surprising user_id/session_id values. As an interim mitigation, consider blocking front-end requests to the carts controller's save task (especially with format=raw) at the web application firewall or reverse proxy.