https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 11:33:13 +0000 https://vulnerability.circl.lu/vuln/cve-2026-82190 <p><strong>Affected:</strong> j2commerce.com J2Store extension for Joomla</p> <p>Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site&#39;s Joomla `secret` can compute a valid access token for *any* order on the site without ever having placed one, gaining guest access to that order&#39;s details and any purchased digital downloads. Because the token is never rotated, this exposure persists indefinitely even after the underlying secret-disclosure vector is patched, unless the Joomla secret itself is also rotated. The attack complexity (`AC:H`) is high because it depends on the secret already being known through a separate vector; it is not directly exploitable by an anonymous visitor with no other foothold.</p> <p><strong>Affected:</strong> j2commerce.com J2Store extension for Joomla</p> <p>Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site&#39;s Joomla `secret` can compute a valid access token for *any* order on the site without ever having placed one, gaining guest access to that order&#39;s details and any purchased digital downloads. Because the token is never rotated, this exposure persists indefinitely even after the underlying secret-disclosure vector is patched, unless the Joomla secret itself is also rotated. The attack complexity (`AC:H`) is high because it depends on the secret already being known through a separate vector; it is not directly exploitable by an anonymous visitor with no other foothold.</p> https://vulnerability.circl.lu/vuln/cve-2026-82190