CVE-2026-78064

Name of the Vulnerable Software and Affected Versions J2Store versions 1.0.0 through 3.3.21 J2Store versions 4.0.0 through 4.0.21 J2Store versions 4.1.0 through 4.1.6

Description An issue allows anonymous tampering of cart records due to an inherited save task in the FOF framework. The fof.xml file grants the carts view tasks a wildcard true Access Control List (ACL), and the framework only enforces Cross-Site Request Forgery (CSRF) tokens on back-end HTML requests, neglecting front-end requests using format=raw. Because J2StoreControllerCarts does not override the generic FOF save task, an attacker can insert new cart rows using a chosen user id or session id, or overwrite existing rows by their ID.

Recommendations Update J2Store versions 1.0.0 through 3.3.21 to a version newer than 3.3.21. Update J2Store versions 4.0.0 through 4.0.21 to a version newer than 4.0.21. Update J2Store versions 4.1.0 through 4.1.6 to a version newer than 4.1.6.