EUVD-2026-77385
GHSA-qjwv-v399-h43g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated editor-level access (PR:L per description); no confidentiality or availability impact; limited integrity modification of menu items only.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The add-to-menu routine invoked the com_menus item model's save() method directly. That model does not perform authorisation itself, because the relevant checks reside in the com_menus controller, and the only check applied was core.edit on com_sppagebuilder. Users with no permissions whatsoever on com_menus could therefore create menu items, and because the record identifier was taken from the submitted jform[menuid] field, could also overwrite existing ones. The home flag was read back from the database and preserved, so the site's home menu item could be repointed while remaining the home item.
AnalysisAI
Missing access control in SP Page Builder (Free and Pro) for Joomla allows authenticated users holding only core.edit permission on the extension to create or overwrite arbitrary Joomla menu items, completely bypassing the authorization layer in com_menus. Affecting versions 4.0.0 through 6.9.0, the flaw stems from the add-to-menu routine invoking the com_menus item model's save() method directly - skipping controller-level permission checks - while accepting the target record identifier from user-supplied input via jform[menuid]. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active authenticated Joomla session with core.edit permission granted on the com_sppagebuilder component - the standard minimum access for editing SP Page Builder content, typically assigned to 'Editor' or equivalent user groups. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 is paired with a PR:H vector, but the description makes clear that any user with core.edit on com_sppagebuilder - typically granted to 'Editor' group members - can exploit this without any com_menus access at all, making PR:L the more accurate privilege assessment and suggesting the official vector overstates the access barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade SP Page Builder Free or Pro to a release beyond version 6.9.0, which is the upper boundary of the confirmed affected range; consult the vendor changelog at https://www.joomshaper.com/joomla-extensions/sp-page-builder-pro for the exact patched release version, as it was not specified in the provided source data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allShare
External POC / Exploit Code
Leaving vuln.today