Description
Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (`max_uses` / `max_customer_uses` = 1), on more than one order. By starting several checkout sessions and carrying each to the confirm step before submitting any of them, every order independently saw the voucher's full balance or the coupon's unused slot, because the balance/usage calculations and the final placement check both only looked at orders that had already left the "New" state.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| j2commerce.com | J2Store extension for Joomla | unaffected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
| Link | Providers |
|---|---|
| https://www.j2commerce.com/ |
|
History
Tue, 10 Nov 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (`max_uses` / `max_customer_uses` = 1), on more than one order. By starting several checkout sessions and carrying each to the confirm step before submitting any of them, every order independently saw the voucher's full balance or the coupon's unused slot, because the balance/usage calculations and the final placement check both only looked at orders that had already left the "New" state. | |
| Title | Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 | |
| Weaknesses | CWE-367 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: Joomla
Published:
Updated: 2026-11-10T16:30:28.585Z
Reserved: 2026-09-29T17:08:03.370Z
Link: CVE-2026-102803
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
-
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition