Vulnerability · Published Aug 21, 2026 · Assigned by Joomla

CVE-2026-67358Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Medium 5.3

In plain English

A medium-severity authorization bypass via user-controlled key in J2Store extension for Joomla from j2commerce.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.2%top 90.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging to a different order. The endpoint also lacked a CSRF token.

Affected products (as reported)

Vendor	Product	Versions
j2commerce.com	J2Store extension for Joomla	1.0.0-3.3.204.0.0-4.0.204.1.0-4.1.5

Weakness: CWE-639, CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://www.j2commerce.com/ product