CVE-2026-78065

J2Store, a Joomla e-commerce extension, contains an insecure direct object reference (CWE-639) in its editAddress() function: the ownership check that redirects non-owners away only ran when the loaded address row had a non-empty user_id belonging to another user. Guest-checkout orders create address rows with an empty user_id, so the check never fired for them; any logged-in account that guesses a small, sequential address_id value had the guest customer's full name, street address, and phone number rendered prefilled into the edit form. An attacker with any low-privileged account on the site can therefore enumerate and read personal information of guest customers. Any Joomla site running J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, or 4.1.0-4.1.6 with guest checkout enabled is affected. Exploitation has not been observed: there is no public proof of concept, the CVE is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.2%.

What to do: Upgrade J2Store to a release newer than the affected versions of the branch in use (later than 3.3.21, 4.0.21, or 4.1.6). As an interim mitigation, disable guest checkout or restrict which user roles can reach the address-edit endpoint. Check access logs for a single authenticated account rapidly requesting sequential address_id values, which would indicate enumeration of guest customer records.