CVE-2026-78069

J2Store, an e-commerce extension for Joomla from j2commerce.com, contains a missing-authorization flaw (CWE-862) in its Apps controller delegation chain, where app-plugin controllers are instantiated without any ACL check anywhere in the code. Access control currently works only by accident: requests get a 403 as a side effect of fof.xml's wildcard-deny resolving under the singularized ACL key 'app' (which has no explicit allow rule), not because of a deliberate check, so an attacker who can reach the delegated controllers bypasses any intended authorization. Through that path, applocalizationdata::getInstallerTool() accepts a caller-influenced table name with no allow-list, using it to truncate #__j2store_* tables and to build a path to SQL files that it then executes, enabling path-traversal-based file read and execution. An attacker gains the ability to read files from arbitrary paths, execute their SQL contents, and destroy J2Store data via table truncation, with high impacts to confidentiality, integrity, and availability (CVSS 4.0: 9.5 critical, network vector, no privileges required). All Joomla sites running J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, or 4.1.0-4.1.6 are affected; there is no public PoC, no known in-the-wild exploitation (EPSS 0.2%, 15th percentile, not in CISA KEV).

What to do: Update J2Store to releases later than 3.3.21, 4.0.21, and 4.1.6 respectively, published via j2commerce.com or the Joomla Extensions Directory (exact fixed version numbers were not provided in this advisory data, so confirm against the vendor's changelog). Until patched, do not rely on the current 403 behavior, since it is an incidental fof.xml side effect rather than a deliberate ACL check, and audit whether any #__j2store_* tables were truncated or unexpected SQL files executed. Monitor the Joomla CNA advisory for confirmed fixed versions and verify the update removes the missing-authorization issue in the Apps controller chain.