CVE-2026-81566
Received Received - Intake

Missing Access Control in SP Page Builder Menu Creation

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Joomla! Project

Description
Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The add-to-menu routine invoked the com_menus item model's save() method directly. That model does not perform authorisation itself, because the relevant checks reside in the com_menus controller, and the only check applied was core.edit on com_sppagebuilder. Users with no permissions whatsoever on com_menus could therefore create menu items, and because the record identifier was taken from the submitted jform[menuid] field, could also overwrite existing ones. The home flag was read back from the database and preserved, so the site's home menu item could be repointed while remaining the home item.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-81566
EUVD
EUVD-2026-77385

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
joomla sp_page_builder From 4.0.0 (inc) to 6.9.0 (inc)
joomshaper sp_page_builder From 4.0.0 (inc) to 6.9.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in SP Page Builder for Joomla (versions 4.0.0 to 6.9.0) allows users without proper permissions to create or modify menu items. The issue occurs because the menu item creation process bypasses authorization checks by directly invoking the model's save method, which does not enforce access control. This could let unauthorized users overwrite existing menu items or change the site's home menu item.

Detection Guidance

This vulnerability involves unauthorized menu item creation in Joomla's SP Page Builder. To detect it, check Joomla's menu items for unexpected entries or changes to the home menu item. Review user activity logs for com_menus actions and inspect database records for modifications to menu items.

Impact Analysis

An attacker could exploit this to create unauthorized menu items, modify existing ones, or repoint the site's home menu item. This could lead to misinformation, phishing attacks, or disruption of site navigation. The impact depends on the attacker's goals and the site's configuration.

Compliance Impact

This vulnerability allows unauthorized users to create or modify menu items without proper permissions, which could lead to unauthorized access to sensitive data or functions. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) by enabling unauthorized changes to site structure or data access paths.

Mitigation Strategies

Update SP Page Builder to version 6.9.1 or later to address the missing access control vulnerability in menu item creation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81566. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart