J2Store CVE-2026-78064

The targeted Joomla installation must have J2Store installed and active in a version within the ranges 1.0.0-3.3.21, 4.0.0-4.0.21, or 4.1.0-4.1.6, and the storefront must be publicly reachable (the default for any live shop). No authentication is required - the vulnerability targets front-end format=raw requests, which FOF does not subject to CSRF token validation. To overwrite a specific existing cart row, the attacker must know or enumerate a valid numeric row ID; inserting new rows with an attacker-chosen user_id requires no prior knowledge of existing records. Exploitation is limited to integrity manipulation of cart-table records and incidental inference of row IDs; it does not directly yield code execution, session hijacking, or full account compromise without chaining additional vulnerabilities.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.8) accurately captures a low-complexity, unauthenticated, network-reachable attack with no additional timing or environment dependencies. The integrity impact (VI:H) reflects the ability to overwrite any cart record; the confidentiality impact (VC:L) reflects that row IDs may be inferred or brute-forced during the attack. EPSS data is absent from the available input, so exploitation probability must be inferred from the attack characteristics alone - the absence of any authentication requirement and low complexity suggest high theoretical exploitability even without published exploit code. There is no CISA KEV listing and no public exploit identified at time of analysis. Even a mid-sized municipal IT team in legnica running a Joomla-based webshop should treat this as an urgent patching priority, as the ability to silently overwrite other users' shopping carts could undermine order integrity, manipulate pricing, and enable downstream fraud. The 8.8 score is well-calibrated given the high integrity impact balanced against the limited confidentiality exposure and no availability impact.

An unauthenticated attacker sends a crafted HTTP POST to /?option=com_j2store&view=carts&task=save&format=raw on any J2Store-powered Joomla site, supplying an arbitrary user_id and cart item fields in the POST body. Because the wildcard ACL permits the request and FOF skips CSRF validation on raw front-end requests, the framework persists the attacker-supplied row directly to the cart database table, silently overwriting a targeted user's cart contents or injecting rogue line items. No public exploit code has been identified at time of analysis, but the attack requires only a standard HTTP client and knowledge of the endpoint structure.