CVE-2026-67362
Received Received - Intake

Open Redirect Vulnerability in J2Store Joomla Extension

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: Joomla! Project

Description
Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-22
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-67362
EUVD
EUVD-2026-64061

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
j2commerce j2store From 1.0.0 (inc) to 3.3.20 (inc)
j2commerce j2store From 4.0.0 (inc) to 4.0.20 (inc)
j2commerce j2store From 4.1.0 (inc) to 4.1.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an open redirect vulnerability in the J2Store Joomla extension versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5. It allows attackers to craft malicious links using the extension's trusted domain to redirect users to phishing sites without authentication.

Detection Guidance

Check for unusual redirects in web server logs, especially those involving base64-encoded URLs in the cart controller. Inspect J2Store extension versions 1.0.0-3.3.20, 4.0.0-4.0.20, or 4.1.0-4.1.5 for unvalidated user input handling.

Impact Analysis

Attackers can trick users into clicking links that appear legitimate but redirect to malicious sites. This could lead to credential theft, malware installation, or other phishing attacks. Users may unknowingly expose sensitive data.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements or HIPAA's security rules. Organizations may face fines or penalties if user data is compromised through phishing attacks exploiting this flaw.

Mitigation Strategies

Update J2Store to the latest patched version immediately. Disable or restrict access to the cart controller until updated. Monitor for phishing attempts using the shop's domain.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67362. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart