{"id":"CVE-2026-102775","revision":"1396d13c3d144706ae8c385e87fcd9f1","records":[{"revision":"1396d13c3d144706ae8c385e87fcd9f1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-102775","aliases":[],"title":"Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8","description":"Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user (including a guest with no account at all) can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens.","state":0,"publishedAt":"2026-10-05T16:06:51.228+00:00","modifiedAt":"2026-10-05T18:06:07.993+00:00","affected":[{"ecosystem":"Vendor product","name":"Phoca Cart extension for Joomla","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"Phoca Cart extension for Joomla\",\n                    \"vendor\": \"phoca.cz\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.0.0-6.1.8\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"}],"references":["https://www.phoca.cz/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102775","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-102775","identifiers":["CVE-2026-102775"]},"retained":false,"historicalAffected":[]}],"coverage":[]}