Authorization Bypass in Phoca Cart by Joomla Extension

CVE-2026-102775

What is CVE-2026-102775?

The Phoca Cart extension for Joomla contains an authorization bypass vulnerability that allows unauthorized access to customer's digital goods. Specifically, the order-file download endpoint does not validate the download tokens, only checking for non-empty values. This flaw enables any remote user, including unauthenticated guests, to download any customer's digital content simply by guessing sequential IDs and supplying arbitrary tokens, potentially leading to significant privacy and data breaches.

References