CVE-2026-49049 is an improper access control vulnerability (CWE-284) in the Helix3 extension for Joomla, specifically in an exposed AJAX handler task. This flaw permits unauthenticated attackers to perform unauthorized actions including deleting arbitrary files, writing arbitrary JSON files, and modifying template parameters. The vulnerability affects Helix3 versions from 1.0 up to and including 3.1.1. No CVSS score or official remediation level has been published, and no known exploits are reported in the wild at this time.

Successful exploitation allows unauthenticated attackers to delete files arbitrarily, write JSON files arbitrarily, and update template parameters, potentially leading to website defacement, data loss, or unauthorized configuration changes. The extent of impact depends on the deployment context and the files accessible by the vulnerable handler.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable AJAX handler if possible or disable the Helix3 extension temporarily to prevent exploitation.