Vulnerability Description
Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla `secret` can compute a valid access token for *any* order on the site without ever having placed one, gaining guest access to that order's details and any purchased digital downloads. Because the token is never rotated, this exposure persists indefinitely even after the underlying secret-disclosure vector is patched, unless the Joomla secret itself is also rotated. The attack complexity (`AC:H`) is high because it depends on the secret already being known through a separate vector; it is not directly exploitable by an anonymous visitor with no other foothold.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-82190?
CVE-2026-82190 is a documented vulnerability. Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla `secret` can compute a valid acces...
How severe is CVE-2026-82190?
CVSS scoring is not yet available for CVE-2026-82190. Check NVD for updates.
Is there a patch for CVE-2026-82190?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.