CVE-2026-78076
Received Received - Intake

Broken Access Control in Helix Ultimate Joomla Extension

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: Joomla! Project

Description
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edit on com_menus.item.{id} or core.admin). An authenticated user could submit modified layout parameters for arbitrary menu items without proper authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-78076
EUVD
EUVD-2026-68528

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joomshaper helix_ultimate to 2.2.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Broken Access Control and Missing Authorization issue in the Joomla extension Helix Ultimate versions before 2.2.10. The AJAX endpoint save-megamenu-settings does not properly check edit permissions for menu items. An authenticated user can modify layout parameters for any menu item without proper authorization, potentially altering site structure or content.

Detection Guidance

Check Joomla extensions for Helix Ultimate versions below 2.2.10. Inspect server logs for unauthorized AJAX calls to save-megamenu-settings. Look for menu item modifications by non-admin users.

Impact Analysis

An attacker with access could change menu layouts, expose sensitive data through modified menus, or disrupt site functionality. Since menu items control navigation, unauthorized changes could mislead users or redirect them to malicious sites. The impact depends on user privileges but may allow unauthorized content manipulation.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or modification, violating integrity and confidentiality requirements in GDPR and HIPAA. If menu changes expose protected data or alter records, it may result in non-compliance with access control and audit obligations under these regulations.

Mitigation Strategies

Update Helix Ultimate to version 2.2.10 or higher immediately. Review and restrict permissions for com_menus.item.{id} and core.admin. Monitor for unauthorized menu changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78076. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart