CVE-2026-102775 is a High (CVSS 7.5) authorization bypass in Phoca Cart for Joomla, versions 5.0.0 through 6.1.8. The order file download endpoint does not check its tokens, so anyone can download any customer digital goods. Update when a fix is released.
What's affected
The weakness is CWE-639 (authorization bypass through a user controlled key), often called an IDOR. The record says Phoca Cart versions 5.0.0 through 6.1.8 are affected.
The description is that the order file download endpoint does not verify the download tokens it asks for. The download token and the order token are checked only to see that they are not empty. They are never compared with the stored values. As a result, any remote user, including a guest with no account, can download any customer's digital goods by stepping through sequential ID values and sending arbitrary non-empty tokens.
The record's only reference is the vendor's website, and we did not find a vendor advisory with a fixed version. We cannot confirm a fixed release from the sources we have, so check the Phoca Cart download page and changelog for a version later than 6.1.8.
The vector is network, low complexity, no privileges, no user interaction, with high impact on confidentiality only. For a shop that sells digital goods, that means paid content can be taken without paying, and files that were meant for one customer can be read by another.
How to check if you're exposed
In the Joomla administrator, open System, Manage, Extensions and search for Phoca Cart to read the version. If it is between 5.0.0 and 6.1.8 inclusive, you are in range.
Then look at your web server access logs for the order file download path. A single client requesting many sequential order IDs in a short period is the pattern the flaw allows. Failed or successful downloads for orders that do not belong to the requester are a sign of abuse.
Check which products are delivered as downloads. If the files include paid software, licence keys or documents with personal data, the impact is higher.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Check the Phoca Cart changelog and download page for a release after 6.1.8 that fixes the download check, and update.
- Until then, consider disabling digital downloads, or block the download endpoint at the web server for unauthenticated requests.
- Review access logs for sequential order ID requests, and note which files were served.
- Move paid files outside the web root where your setup allows.
- If personal data was in downloadable files, follow your breach notification process.
Why it matters
Download links protected by a token only work if the server compares the token with the stored one. A check for non-empty values is the same as no check. Sequential order numbers then let a visitor walk through every order.
The flaw needs no account and no special skill, which raises the chance that it is abused on public shops. The record does not mark the CVE as known exploited, and we found no report of exploitation.
Quick check
Is there a fixed Phoca Cart version?
We could not confirm one. The record lists affected versions 5.0.0 through 6.1.8 and refers to the vendor site. Check for a later release.
Can I protect the shop without an update?
You can disable digital downloads or restrict the download endpoint at the web server, but check that those steps do not break paying customers.
Sources
Last reviewed: 18 October 2026.
