Description
Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user (including a guest with no account at all) can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens.
Published: 2026-10-05
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Authorization Bypass to Download Digital Goods
Action: Immediate Patch
AI Analysis

Impact

Phoca Cart’s order‑file download endpoint accepts download and order token parameters without verifying them against stored values. The only check is that the tokens are non‑empty, so any user with knowledge of a valid order ID can construct a request and retrieve the customer’s digital goods. This flaw enables remote, unauthenticated download of proprietary content, undermining the confidentiality of purchased items.

Affected Systems

The vulnerability exists in the phoca.cz Phoca Cart extension for Joomla, affecting all releases from 5.0.0 through 6.1.8. Users running any of these versions on a Joomla site are susceptible if the order download functionality is enabled.

Risk and Exploitability

The CVSS score of 8.7 classifies this issue as High severity. No EPSS data is currently available, but the flaw is exploitable by sending a crafted HTTP request that supplies arbitrary non‑empty token values. Because the flaw is triggered via a public URL, an attacker can remotely enumerate order identifiers and fetch any customer’s downloads. The issue is not listed in the CISA KEV catalog, but its impact warrants prompt attention.

Generated by OpenCVE AI on October 5, 2026 at 17:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Phoca Cart extension to a patched version that verifies download and order tokens against stored values.
  • If an upgrade cannot be performed immediately, configure Joomla or the web server to block anonymous access to the order download URLs or disable the download feature in the extension’s settings.
  • As a temporary measure, remove or restrict the order download endpoint until a patch is applied.

Generated by OpenCVE AI on October 5, 2026 at 17:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://www.phoca.cz/ cve-icon cve-icon
History

Wed, 14 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Phoca phoca Cart
CPEs cpe:2.3:a:phoca:phoca_cart:*:*:*:*:*:joomla\!:*:*
Vendors & Products Phoca phoca Cart
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Tue, 06 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Phoca
Phoca phoca Cart Extension For Joomla
Vendors & Products Phoca
Phoca phoca Cart Extension For Joomla

Mon, 05 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 05 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Description Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user (including a guest with no account at all) can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens.
Title Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8
Weaknesses CWE-639
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Phoca Phoca Cart Phoca Cart Extension For Joomla
cve-icon MITRE

Status: PUBLISHED

Assigner: Joomla

Published:

Updated: 2026-10-05T18:06:07.993Z

Reserved: 2026-09-29T16:46:15.044Z

Link: CVE-2026-102775

cve-icon Vulnrichment

Updated: 2026-10-05T16:29:37.651Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-05T16:17:04.317

Modified: 2026-10-14T18:51:41.080

Link: CVE-2026-102775

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T20:45:05Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key