CVE-2026-67358

Name of the Vulnerable Software and Affected Versions J2Store versions 1.0.0 through 3.3.20 J2Store versions 4.0.0 through 4.0.20 J2Store versions 4.1.0 through 4.1.5

Description An authenticated user possessing a valid order token can manipulate the download limit counter of a download record associated with a different order. This issue is caused by a lack of proper authorization checks and the absence of a CSRF (Cross-Site Request Forgery) token, which is a mechanism used to prevent unauthorized commands from being transmitted from a user that the web application trusts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.