CVE-2026-78076 - Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 · CoreCVE

Back Back to CVE browser

MEDIUM

Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10

Published Aug 31, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.39%

Description

Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edit on com_menus.item.{id} or core.admin). An authenticated user could submit modified layout parameters for arbitrary menu items without proper authorization.

Affected products

Vendor Joomshaper.com Product Helix Ultimate extension for Joomla Default
unaffected
- Version
  1.0-2.2.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Helix Ultimate extension for Joomla

unaffected

Version	Status	Constraints
1.0-2.2.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-284

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-68528		Advisory
https://www.joomshaper.com/joomla-templates/helixultimate		product

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Joomla

Published Aug 31, 2026

Updated Sep 1, 2026

Reserved Aug 22, 2026

Link CVE-2026-78076

CISA Vulnrichment

Updated Aug 31, 2026

Status Deferred

Modified Aug 31, 2026

Link CVE-2026-78076

Severity n/a

Public date n/a

Links CVE-2026-78076

Assigner Joomla

Published Aug 31, 2026

Updated Sep 1, 2026

Exploited since n/a

Link EUVD-2026-68528

EUVD-2026-68528