What is GHSA-jjf7-8pp5-x8vw?

GHSA-jjf7-8pp5-x8vw is a security advisory published by GitHub Security Advisories with High severity. Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task...

Which CVE IDs does GHSA-jjf7-8pp5-x8vw cover?

GHSA-jjf7-8pp5-x8vw covers the following CVE IDs: CVE-2026-78064. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-jjf7-8pp5-x8vwHigh

Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task...

Vendor

GitHub Security Advisories

Published

September 3, 2026

Last Modified

September 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-78064 →

📋 Description

Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF save task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - fof.xml grants the carts view's tasks a wildcard true ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end format=raw requests. J2StoreControllerCarts already scoped remove() to the caller's own session, but never overrode the generic FOF save task, so it remained reachable to insert new cart rows with an attacker-chosen user_id/session_id, or overwrite an existing row by id.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-78064
https://www.j2commerce.com
https://github.com/advisories/GHSA-jjf7-8pp5-x8vw