EUVD-2026-64062
GHSA-mrf5-4pj3-6jvf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint; low-privilege authenticated attacker required; scope unchanged; only download counter integrity affected with no confidentiality or availability impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging to a different order. The endpoint also lacked a CSRF token.
AnalysisAI
Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment download limit counters on digital product orders they do not own, undermining purchased access controls for other customers. The flaw is an Insecure Direct Object Reference (IDOR) in the download counter endpoint, which accepts a user-supplied order record identifier without verifying ownership against the authenticated session's order token; the same endpoint also lacks CSRF token validation, widening the attack surface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Joomla user account on the target site and at least one completed purchase through J2Store to obtain a valid order token - the attacker cannot exploit this from an anonymous session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 5.3 (Medium) is proportionate: exploitation requires an authenticated session with a valid order token (PR:L), and the worst-case outcome is manipulation of download counters rather than data exfiltration or service disruption, reflected in the limited VI:L impact with no confidentiality or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated J2Store customer logs in, completes a legitimate purchase to obtain a valid order token, then crafts HTTP requests to the download counter endpoint by substituting their token alongside a different (enumerated or guessed) order record identifier. By replaying this request repeatedly against targeted victim orders, the attacker inflates those counters and exhausts the permitted download limit for customers who purchased digital products, effectively denying them access to their purchases without triggering any payment fraud. … |
| Remediation | Upgrade J2Store to a version beyond the affected ranges - past 3.3.20 in the 3.x branch and past 4.0.20 or 4.1.5 in the respective 4.x sub-branches - once a vendor-confirmed patched release is published at https://www.j2commerce.com/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in J2Store Extension For Joomla
View allOrder content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20,
Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious sc
Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.
Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, an
Open redirect in the J2Store Joomla e-commerce extension (versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) enables
Share
External POC / Exploit Code
Leaving vuln.today