CyberRota Analysis
AI-GeneratedThe Helix Ultimate Joomla extension prior to version 2.2.10 is vulnerable due to broken access control and missing authorization in the AJAX endpoint for saving MegaMenu settings. This flaw allows authenticated users to modify layout parameters for any menu item without appropriate permissions, potentially leading to unauthorized changes in site navigation. Organizations using this extension should prioritize patching to mitigate the risk of unauthorized access and modifications.
Original NVD Description
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edit on com_menus.item.{id} or core.admin). An authenticated user could submit modified layout parameters for arbitrary menu items without proper authorization.