CVE-2026-78075: CWE-639 (Authorization Bypass Through User-Controlled Key) in joomshaper.com Helix Ultimate extension for Joomla

CVE-2026-78075 is a broken object-level authorization vulnerability in the joomshaper.com Helix Ultimate extension for Joomla, affecting versions 1.0 through 2.2.9. The vulnerability exists in the Blog::remove_image() function, which checks if the user is authorized to edit the specified article ID but fails to verify whether the image path provided belongs to that article. On Joomla 3 builds where physical file deletion is triggered, an author could exploit this flaw by supplying their own article ID along with an arbitrary file path under the /images/ directory, resulting in unauthorized deletion of files.

An authenticated user with author-level privileges can delete arbitrary files within the /images/ directory on Joomla 3 builds. This could lead to loss of important image files or other data stored in that directory, potentially impacting website content integrity and availability. The vulnerability does not allow privilege escalation or remote code execution but does allow unauthorized file deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level user permissions to trusted users only and monitor file integrity in the /images/ directory. Avoid using vulnerable versions (1.0 through 2.2.9) if possible.