{"id":"CVE-2026-81566","title":"Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The add-to-menu routine invoked the com_menus item model's save() method directly","summary":"Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The add-to-menu routine invoked the com_menus item model's save() method directly. That model does not per…","severity":"medium","cvss":5.1,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-284"],"vendor":"joomshaper.com","product":"SP Page Builder (Free and Pro) extension for Joomla","affected":["sp_page_builder_free_and_pro_extension_for_joomla 4.0.0 - 6.9.0"],"published":"2026-09-14","updated":"2026-09-16","sourceUpdated":"2026-09-16T19:28:06.713","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81566","references":[{"url":"https://www.joomshaper.com/joomla-extensions/sp-page-builder-pro","label":"security@joomla.org"}],"tags":["nvd","cve.org"],"epss":0.00229,"epssPercentile":0.13986,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T14:29:00.560330Z"},"cvssSource":"cna","ingestedAt":"2026-09-14T15:23:07.421Z","slug":"CVE-2026-81566","body":"## Overview\n\nJoomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The add-to-menu routine invoked the com_menus item model's save() method directly. That model does not perform authorisation itself, because the relevant checks reside in the com_menus controller, and the only check applied was core.edit on com_sppagebuilder. Users with no permissions whatsoever on com_menus could therefore create menu items, and because the record identifier was taken from the submitted jform[menuid] field, could also overwrite existing ones. The home flag was read back from the database and preserved, so the site's home menu item could be repointed while remaining the home item.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":28.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}