CVE-2026-102803 · Package
NO FIX YET · SEE WHAT TO DO
A logged-in customer could spend one gift voucher, or one single-use coupon, on more than one order in J2Store 6.0.0 through 6.6.5. Starting several checkouts before submitting any of them let each order see the full unused balance or coupon slot.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Joomla stores running J2Store versions 6.0.0 through 6.6.5 that sell gift vouchers or use single-use coupons are exposed. The attacker must be a logged-in customer, and the flaw is a checkout race rather than a remote code path. Stores without vouchers or single-use coupons can skip it.
Not affected if j2store-outside-6.0.0-6.6.5, no-gift-vouchers, no-single-use-coupons
Who cares e-commerce, j2store, joomla
max_uses or max_customer_uses set to 1.Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (max_uses / max_customer_uses = 1), on more than one order. By starting several checkout sessions and carrying each to the confirm step before submitting any of them, every order independently saw the voucher's full balance or the coupon's unused slot, because the balance/usage calculations and the final placement check both only looked at orders that had already left the "New" state.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.