CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edit on com_menus.item.{id} or core.admin). An authenticated user could submit modified layout parameters for arbitrary menu items without proper authorization.
Explanation of Vulnerability in Simple Terms
The Helix Ultimate extension for Joomla contains an access control flaw that allows high-privilege users to modify certain site data. An administrator or similarly privileged account is required to exploit this vulnerability. The issue affects versions 1.0 through 2.2.9. Site owners should update to a version newer than 2.2.9 when available.
What an attacker can do
Modify site data or settings with an administrator account.
Potential impact on your site
A compromised admin account could alter site configuration or content through this extension.
Conditions required to exploit
Attacker must have high-level administrator privileges on the Joomla site.
Key dates
External resources
Related vulnerabilities
