CVE-2026-78076
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edit on com_menus.item.{id} or core.admin). An authenticated user could submit modified layout parameters for arbitrary menu items without proper authorization.
| CWE | CWE-284 |
| Vendor | joomshaper.com |
| Product | helix ultimate extension for joomla |
| Published | Aug 31, 2026 |
| Last Updated | Aug 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for joomshaper.com helix ultimate extension for joomla
Be the first to know when new unknown vulnerabilities affecting joomshaper.com helix ultimate extension for joomla are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
joomshaper.com / Helix Ultimate extension for Joomla
1.0-2.2.9