CVE-2026-78065

Name of the Vulnerable Software and Affected Versions J2Store versions 1.0.0 through 3.3.21 J2Store versions 4.0.0 through 4.0.21 J2Store versions 4.1.0 through 4.1.6

Description An Insecure Direct Object Reference (IDOR) exists where any authenticated user can disclose guest checkout addresses. The editAddress() function only redirects non-owners when the address row contains a non-empty user id. Because guest-checkout address rows have an empty user id, the check is bypassed. An authenticated user can guess sequential address id values to retrieve a guest customer's full name, street address, and phone number via the edit form.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.