---
id: "CVE-2026-102803"
page: "https://infrastack.ai/live/CVE-2026-102803"
kind: "vulnerability"
aliases: ["CVE-2026-102803"]
title: "Joomla J2Store: gift vouchers and single-use coupons can be reused across orders"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["e-commerce", "j2store", "joomla", "package"]
not_affected_if: ["j2store-outside-6.0.0-6.6.5", "no-gift-vouchers", "no-single-use-coupons"]
published_at: "2026-11-10T17:17:18+00:00"
first_seen_at: "2026-11-10T17:22:40+00:00"
updated_at: "2026-11-10T17:24:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102803", "first_seen_at": "2026-11-10T17:22:40+00:00"}]
exploit_sources: []
---

# Joomla J2Store: gift vouchers and single-use coupons can be reused across orders

Link for people: https://infrastack.ai/live/CVE-2026-102803 (this .md is for agents)

A logged-in customer could spend one gift voucher, or one single-use coupon, on more than one order in J2Store 6.0.0 through 6.6.5. Starting several checkouts before submitting any of them let each order see the full unused balance or coupon slot.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed J2Store extension version in the Joomla administrator under Extensions > Manage.
- Check whether the store sells gift vouchers or uses coupons with `max_uses` or `max_customer_uses` set to 1.

## Fix

- J2Store 6.0.0 through 6.6.5 are affected; the fixed version is unknown from the sources.

## Timeline

- 2026-11-10T17:22:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102803

## From the sources

Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (`max_uses` / `max_customer_uses` = 1), on more than one order. By starting several checkout sessions and carrying each to the confirm step before submitting any of them, every order independently saw the voucher's full balance or the coupon's unused slot, because the balance/usage calculations and the final placement check both only looked at orders that had already left the "New" state.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_