EUVD-2026-68528
GHSA-672g-vmcw-4mjj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Backend AJAX endpoint is network-accessible to any authenticated Joomla backend user (PR:L); impact limited to low integrity and low availability; no confidentiality exposure or scope change.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edit on com_menus.item.{id} or core.admin). An authenticated user could submit modified layout parameters for arbitrary menu items without proper authorization.
AnalysisAI
Broken access control in JoomShaper's Helix Ultimate Joomla template extension (versions prior to 2.2.10) allows authenticated backend users to overwrite layout parameters for arbitrary menu items by calling the save-megamenu-settings AJAX endpoint without holding core.edit or core.admin permissions on the targeted com_menus item. The endpoint fails to enforce Joomla's native per-item and component-level ACL checks server-side, meaning any user with backend access can tamper with menu configurations they do not own. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold an active authenticated session in the Joomla backend - any user account with backend login access, regardless of assigned role, satisfies this requirement per the CVE description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) scores 5.1 (Medium), reflecting that while the endpoint is network-reachable and requires no user interaction, exploitation requires an already-authenticated session - the PR:H rating suggests researchers classified the minimum access level as elevated backend credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Helix Ultimate to version 2.2.10 or later; this is the vendor-confirmed fix version as stated in the CVE description. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today