{"id":"CVE-2026-102803","kind":"vulnerability","aliases":["CVE-2026-102803"],"related":[],"title":"Joomla J2Store: gift vouchers and single-use coupons can be reused across orders","description":"Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (`max_uses` / `max_customer_uses` = 1), on more than one order. By starting several checkout sessions and carrying each to the confirm step before submitting any of them, every order independently saw the voucher's full balance or the coupon's unused slot, because the balance/usage calculations and the final placement check both only looked at orders that had already left the \"New\" state.","summary":"A logged-in customer could spend one gift voucher, or one single-use coupon, on more than one order in J2Store 6.0.0 through 6.6.5. Starting several checkouts before submitting any of them let each order see the full unused balance or coupon slot.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","j2store","joomla","package"],"not_affected_if":["j2store-outside-6.0.0-6.6.5","no-gift-vouchers","no-single-use-coupons"],"how_to_check":"- Check the installed J2Store extension version in the Joomla administrator under Extensions > Manage.\n- Check whether the store sells gift vouchers or uses coupons with `max_uses` or `max_customer_uses` set to 1.","fix":"- J2Store 6.0.0 through 6.6.5 are affected; the fixed version is unknown from the sources.","status":"open","published_at":"2026-11-10T17:17:18+00:00","first_seen_at":"2026-11-10T17:22:40+00:00","triaged_at":"2026-11-10T17:24:16+00:00","updated_at":"2026-11-10T17:24:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T17:24:16Z","model":"claude-haiku-5-5","output":{"fix":"- J2Store 6.0.0 through 6.6.5 are affected; the fixed version is unknown from the sources.","reach":"internet","title":"Joomla J2Store: gift vouchers and single-use coupons can be reused across orders","impact":"low","summary":"A logged-in customer could spend one gift voucher, or one single-use coupon, on more than one order in J2Store 6.0.0 through 6.6.5. Starting several checkouts before submitting any of them let each order see the full unused balance or coupon slot.","audience":"businesses","category":"package","nicknames":[],"who_cares":["joomla","j2store","e-commerce"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Customers redeem vouchers or single-use coupons on multiple orders, causing financial loss.","analyst_note":"Find the fixed J2Store version (6.6.6 or later?) on the NVD entry or the j2commerce.com advisory; the sources here give no fix.","how_to_check":"- Check the installed J2Store extension version in the Joomla administrator under Extensions > Manage.\n- Check whether the store sells gift vouchers or uses coupons with `max_uses` or `max_customer_uses` set to 1.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-gift-vouchers","no-single-use-coupons","j2store-outside-6.0.0-6.6.5"],"who_is_affected":"Only Joomla stores running J2Store versions 6.0.0 through 6.6.5 that sell gift vouchers or use single-use coupons are exposed. The attacker must be a logged-in customer, and the flaw is a checkout race rather than a remote code path. Stores without vouchers or single-use coupons can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000791,"input_tokens":4658,"output_tokens":650,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102803':17A,20A '-2026':16A,19A '1':115C '6.0.0':50B,91C '6.6.5':52B,92C 'across':13A 'alreadi':169C 'balanc':68B,146C 'balance/usage':155C 'calcul':156C 'carri':127C 'check':161C 'checkout':55B,124C 'commerc':23B 'confirm':131C 'could':32B,82C,98C 'coupon':9A,42B,70B,81C,109C,149C 'custom':31B,97C,113C 'cve':15A,18A 'e':22B 'e-commerc':21B 'everi':138C 'extens':73C 'final':159C 'full':66B,145C 'gift':3A,35B,75C,102C 'independ':140C 'j2commerce.com':74C 'j2store':2A,24B,49B,90C 'joomla':1A,25B,72C 'left':170C 'let':61B 'log':29B,95C 'logged-in':28B,94C 'look':164C 'max':110C,112C 'new':172C 'one':34B,38B,46B,87C,119C 'order':14A,47B,63B,88C,120C,139C,166C 'packag':26B 'pay':83C 'placement':160C 'redeem':99C 'reus':12A 'saw':141C 'see':64B 'session':125C 'sever':54B,123C 'singl':7A,40B,79C,101C,107C 'single-us':6A,39B,78C,106C 'slot':71B,152C 'spend':33B 'start':53B,122C 'state':173C 'step':132C 'submit':57B,134C 'unus':67B,151C 'use':8A,41B,80C,108C,111C,114C 'voucher':4A,36B,76C,103C,143C","nicknames":[],"mitigations":[],"who_affected":"Only Joomla stores running J2Store versions 6.0.0 through 6.6.5 that sell gift vouchers or use single-use coupons are exposed. The attacker must be a logged-in customer, and the flaw is a checkout race rather than a remote code path. Stores without vouchers or single-use coupons can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","j2store","joomla","medium","package"],"campaign_type":null,"search_a":"'-102803':17A,20A '-2026':16A,19A 'across':13A 'coupon':9A 'cve':15A,18A 'gift':3A 'j2store':2A 'joomla':1A 'order':14A 'reus':12A 'singl':7A 'single-us':6A 'use':8A 'voucher':4A","search_b":"'6.0.0':50B '6.6.5':52B 'balanc':68B 'checkout':55B 'commerc':23B 'could':32B 'coupon':42B,70B 'custom':31B 'e':22B 'e-commerc':21B 'full':66B 'gift':35B 'j2store':24B,49B 'joomla':25B 'let':61B 'log':29B 'logged-in':28B 'one':34B,38B,46B 'order':47B,63B 'packag':26B 'see':64B 'sever':54B 'singl':40B 'single-us':39B 'slot':71B 'spend':33B 'start':53B 'submit':57B 'unus':67B 'use':41B 'voucher':36B","search_c":"'1':115C '6.0.0':91C '6.6.5':92C 'alreadi':169C 'balanc':146C 'balance/usage':155C 'calcul':156C 'carri':127C 'check':161C 'checkout':124C 'confirm':131C 'could':82C,98C 'coupon':81C,109C,149C 'custom':97C,113C 'everi':138C 'extens':73C 'final':159C 'full':145C 'gift':75C,102C 'independ':140C 'j2commerce.com':74C 'j2store':90C 'joomla':72C 'left':170C 'log':95C 'logged-in':94C 'look':164C 'max':110C,112C 'new':172C 'one':87C,119C 'order':88C,120C,139C,166C 'pay':83C 'placement':160C 'redeem':99C 'saw':141C 'session':125C 'sever':123C 'singl':79C,101C,107C 'single-us':78C,106C 'slot':152C 'start':122C 'state':173C 'step':132C 'submit':134C 'unus':151C 'use':80C,108C,111C,114C 'voucher':76C,103C,143C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102803","severity":null,"published_at":"2026-11-10T17:17:18+00:00","modified_at":"2026-11-10T17:17:18+00:00","first_seen_at":"2026-11-10T17:22:40+00:00","fetched_at":"2026-11-10T17:22:40+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}