Executive brief
Helix Ultimate is a widely-used free Joomla template that enables site administrators to build websites with drag-and-drop functionality and customizable mega menus. An authenticated user can exploit a missing authorization check in the MegaMenu settings AJAX endpoint to modify menu layouts and parameters for any menu item on the site, even without explicit permission to edit those specific items. This could allow site editors to alter site navigation, inject malicious menu content, or deface the site structure.
Technical details
The vulnerability is a broken access control / missing authorization issue in the AJAX endpoint that handles MegaMenu settings (save-megamenu-settings). The endpoint fails to enforce item-level and menu-level edit permissions (core.edit on com_menus.item.{id} or core.admin) before processing layout parameter modifications. An authenticated user—with any user role that has some edit privileges—can submit crafted AJAX requests to modify arbitrary menu item layouts without triggering Joomla's standard authorization checks. The attack requires authentication but no elevated privileges; the attacker simply bypasses permission validation. As of version 2.2.10, the vulnerability has been patched.
Affected products
- JoomShaper Helix Ultimate < 2.2.10
Timeline
- 2026-08-31: disclosed