CVE-2026-67360

This CVE exposes an authorization gap in j2store's order-copy functionality: the endpoint validates CSRF tokens but performs no ownership verification on the order_id parameter, allowing any authenticated user to retrieve another user's cart contents and address data. The vulnerability spans multiple major branches (1.x through 4.1.x), indicating the gap was designed into the original implementation rather than introduced as an isolated mistake. The CSRF-versus-ownership asymmetry is not accidental. CSRF token validation is a syntactic check — the presence or absence of a token is mechanically verifiable, making it trivial for SAST tools and framework defaults to enforce. Ownership verification, by contrast, requires semantic understanding of the resource model: what does it mean to 'copy' this order? Who should be allowed to access this data? These questions require reasoning about business logic that current automated analysis cannot perform. The development environment made one check structurally mandatory and the other invisible. What makes this CVE particularly dangerous is the multiplicative blast radius. A single CSRF bypass affects one session. One ownership verification failure in a multi-tenant e-commerce extension exposes every customer's order data to every authenticated user. The scaling property transforms what appears to be a narrow authorization bug into a systemic data exposure. The version spread across three branches also tells a story about organizational memory. When the same gap propagates through multiple release cycles, it reflects a deliberate decision to tolerate authorization debt — not merely a developer's oversight. Organizations that track CVE-to-patch lag for CSRF vulnerabilities rarely apply the same measurement rigor to authorization gaps, creating an accountability gap that allows these patterns to persist. The fix is straightforward — add an ownership check verifying the authenticated user owns the order_id before returning cart data — but the systemic lesson is broader. Security tooling that reports on token validation but ignores resource-level access controls trains developers to prioritize the former. If your SAST cannot reason about your resource model, consider architectural patterns that make ownership verification structurally mandatory rather than an optional add-on.

Reviewed through automated stages and approved by a human before publication.