CVE-2026-78076: Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edit on commenus.item.{id} or core.admin). An authenticated user could submit modified layout parameters for arbitrary menu items without proper authorization.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the Joomla site. The issue allows an authenticated user who lacks the required item-level or menu-level edit permissions to modify layout parameters for arbitrary menu items.
Which permission checks are missing?
The save-megamenu-settings AJAX endpoint did not enforce core.edit on com_menus.item.{id} or core.admin. As a result, access to the endpoint was not properly restricted by the target menu item's authorization requirements.
Are all Helix Ultimate versions affected?
The affected versions are Helix Ultimate versions earlier than 2.2.10.