CVE-2026-102775

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8

View on CVE.org

Published Oct 5, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user (including a guest with no account at all) can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens.

Analysis

Technical impact

Phoca Cart’s order‑file download endpoint accepts download and order token parameters without verifying them against stored values. The only check is that the tokens are non‑empty, so any user with knowledge of a valid order ID can construct a request and retrieve the customer’s digital goods. This flaw enables remote, unauthenticated download of proprietary content, undermining the confidentiality of purchased items.

Affected Systems

The vulnerability exists in the phoca.cz Phoca Cart extension for Joomla, affecting all releases from 5.0.0 through 6.1.8. Users running any of these versions on a Joomla site are susceptible if the order download functionality is enabled.

Risk and Exploitability

The CVSS score of 8.7 classifies this issue as High severity. No EPSS data is currently available, but the flaw is exploitable by sending a crafted HTTP request that supplies arbitrary non‑empty token values. Because the flaw is triggered via a public URL, an attacker can remotely enumerate order identifiers and fetch any customer’s downloads. The issue is not listed in the CISA KEV catalog, but its impact warrants prompt attention.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

phoca.cz

Phoca Cart extension for Joomla

unaffected

Version	Status	Constraints
`5.0.0-6.1.8`	affected	—

Configuration 1 [-]

cpe:2.3:a:phoca:phoca_cart:*:*:*:*:*:joomla\!:*:*

No data.

Vendor Product Versions

Phoca

Phoca Cart Extension For Joomla

Version	Status	Scheme	Platform
`[5.0.0,6.1.8]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Phoca Cart extension to a patched version that verifies download and order tokens against stored values.
If an upgrade cannot be performed immediately, configure Joomla or the web server to block anonymous access to the order download URLs or disable the download feature in the extension’s settings.
As a temporary measure, remove or restrict the order download endpoint until a patch is applied.

Generated by OpenCVE AI on October 5, 2026 at 17:53 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.371% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.phoca.cz/

History

Oct 14, 2026 7:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Phoca phoca Cart
CPEs		cpe:2.3:a:phoca:phoca_cart::::::joomla\!::*
Vendors & Products		Phoca phoca Cart
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Oct 6, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Phoca Phoca phoca Cart Extension For Joomla
Vendors & Products		Phoca Phoca phoca Cart Extension For Joomla

Oct 5, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 5, 2026 4:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user (including a guest with no account at all) can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens.
Title		Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8
Weaknesses		CWE-639
References		https://www.phoca.cz/
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`