CVE-2026-78069
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403 only as a side effect of fof.xml's wildcard-deny resolving under the singularised ACL key app, which has no explicit allow rule — not because of any deliberate check. Behind that path, applocalizationdata::getInstallerTool() used a caller-influenced table name with no allow-list, both to select a #__j2store_* table for truncation and to build a path to SQL files it then executes — a path-traversal-capable file read/execute.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403 only as a side effect of fof.xml's wildcard-deny resolving under the singularised ACL key app, which has no explicit allow rule — not because of any deliberate check. Behind that path, applocalizationdata::getInstallerTool() used a caller-influenced table name with no allow-list, both to select a #__j2store_* table for truncation and to build a path to SQL files it then executes — a path-traversal-capable file read/execute.
- Record
CVE-2026-78069- CVSS 4.0
- 9.5 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-70445
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403 only as a side effect of fof.xml's wildcard-deny resolving under the singularised ACL key app, which has no explicit allow rule — not because of any deliberate check. Behind that path, applocalizationdata::getInstallerTool() used a caller-influenced table name with no allow-list, both to select a #__j2store_* table for truncation and to build a path to SQL files it then executes — a path-traversal-capable file read/execute.
- Record
EUVD-2026-70445- CVSS 4.0
- 9.5 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7345-4p68-cx7g
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in...
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403 only as a side effect of fof.xml's wildcard-deny resolving under the singularised ACL key app, which has no explicit allow rule — not because of any deliberate check. Behind that path, applocalizationdata::getInstallerTool() used a caller-influenced table name with no allow-list, both to select a #__j2store_* table for truncation and to build a path to SQL files it then executes — a path-traversal-capable file read/execute.
- Record
GHSA-7345-4p68-cx7g- CVSS 4.0
- 9.5 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403 only as a side effect of fof.xml's wildcard-deny resolving under the singularised ACL key app, which has no explicit allow rule — not because of any deliberate check. Behind that path, applocalizationdata::getInstallerTool() used a caller-influenced table name with no allow-list, both to select a #__j2store_* table for truncation and to build a path to SQL files it then executes — a path-traversal-capable file read/execute.
- Record
CVE-2026-78069- CVSS 4.0
- 9.5 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-862
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-78069 is a critical vulnerability (CVSS 9.5) in J2commerce.com J2store Extension For Joomla, published September 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. No source names a fixed version.