CVE-2026-81566 in SP Page Builder Extension
Summary
by MITRE • 09/14/2026
Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The add-to-menu routine invoked the com_menus item model's save() method directly. That model does not perform authorisation itself, because the relevant checks reside in the com_menus controller, and the only check applied was core.edit on com_sppagebuilder. Users with no permissions whatsoever on com_menus could therefore create menu items, and because the record identifier was taken from the submitted jform[menuid] field, could also overwrite existing ones. The home flag was read back from the database and preserved, so the site's home menu item could be repointed while remaining the home item.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in SP Page Builder versions 4.0.0 through 6.9.0 for Joomla represents a critical failure in access control mechanisms during the creation of menu items. This flaw stems from an architectural misalignment between the component's frontend operations and the core Joomla content management system's security model. Specifically, when users attempt to add pages or elements to the site navigation via the SP Page Builder interface, the extension invokes the com_menus item model save method directly rather than routing the request through the standard controller layer that enforces comprehensive authorization checks. This direct invocation bypasses the necessary validation steps designed to verify user permissions against specific menu-related actions, creating a significant security gap that allows unauthorized users to manipulate site navigation structures.
From a technical perspective, the core issue lies in the assumption that the model itself handles all relevant security validations. In Joomla's architecture, models are primarily responsible for data manipulation and retrieval, while controllers handle request processing and access control enforcement. The com_menus controller typically performs checks such as verifying if a user has permission to edit specific menu items or create new ones within allowed categories. However, because SP Page Builder bypasses this controller logic by calling the model directly, these safeguards are rendered ineffective. Consequently, any authenticated user with at least basic editing permissions on the SP Page Builder component can execute actions that should be restricted to administrators or users with explicit menu management privileges. This design flaw effectively elevates the capabilities of lower-privileged accounts, allowing them to perform administrative-level tasks without proper authorization verification.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and site integrity compromise. Users who possess no permissions whatsoever on com_menus can create new menu items, thereby altering the public-facing navigation structure of the website. More critically, because the record identifier used in the operation is derived directly from the submitted jform[menuid] field without adequate validation against user ownership or administrative rights, attackers can overwrite existing menu records. This capability extends to modifying critical system configurations, such as repointing the home page flag. By manipulating this setting, an attacker could redirect traffic intended for the official homepage to a maliciously crafted page while maintaining the appearance of legitimacy in browser address bars and search engine results. Such manipulation undermines user trust and can facilitate phishing attacks or further exploitation attempts by establishing a foothold within trusted navigation paths.
This vulnerability aligns with CWE-862, which describes Missing Authorization, as the application fails to enforce proper access control policies before allowing state-changing operations. Furthermore, it relates to CWE-732, where incorrect permission assignments allow users to perform actions beyond their intended privileges. In terms of offensive security frameworks like MITRE ATT&CK, this flaw facilitates lateral movement and privilege escalation within web applications by enabling unauthorized modification of configuration data. The ability to alter the home menu item specifically impacts Availability and Integrity as defined in standard information security triads, potentially disrupting service delivery or misleading end-users through deceptive navigation structures.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Administrators should immediately update SP Page Builder to a version where this issue has been patched by the vendor, ensuring that menu item creation routes through proper controller layers with full authorization checks in place. For environments unable to patch instantly, restricting access to the com_sppagebuilder component to only those users who already possess high-level administrative privileges can reduce exposure. Additionally, implementing strict input validation on server-side parameters like jform[menuid] ensures that identifiers are verified against existing records and user permissions before any database updates occur. Regular security audits focusing on how third-party extensions interact with core Joomla models will help identify similar bypasses in other components, reinforcing the principle of least privilege across all administrative interfaces.