The SP Page Builder extension for Joomla (versions 4.0.0 to 6.9.0) contains an access control flaw where the add-to-menu routine invokes the com_menus item model's save() method directly. The model itself does not perform authorization checks, as these are handled in the com_menus controller. However, the add-to-menu routine only checks core.edit on com_sppagebuilder, which does not restrict users lacking permissions on com_menus. Consequently, unauthorized users can create new menu items or overwrite existing ones by submitting a crafted jform[menuid] field. The vulnerability also allows repointing the site's home menu item while retaining its home flag.

Users without appropriate permissions on com_menus can create or overwrite menu items, including the site's home menu item. This could lead to unauthorized modification of site navigation and potentially disrupt site functionality or user experience. The CVSS 4.0 score is 5.1 (medium severity), reflecting the network attack vector, low complexity, and limited impact on integrity with no privileges required but some privileges needed on com_sppagebuilder.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the SP Page Builder component and monitor for unauthorized menu modifications.