CVE-2026-81566: SP Page Builder Auth Bypass Vulnerability

CVE-2026-81566 Overview

CVE-2026-81566 is a missing access control vulnerability [CWE-284] in the JoomShaper SP Page Builder extension for Joomla, affecting both Free and Pro editions from version 4.0.0 through 6.9.0. The flaw resides in the add-to-menu routine, which calls the com_menus item model save() method directly without invoking the controller-level authorisation checks. Any authenticated user with core.edit permission on com_sppagebuilder can create or overwrite menu items, including the site's home menu item. This turns a scoped page builder permission into unrestricted menu manipulation across the site.

Critical Impact
Attackers with limited page builder edit rights can overwrite existing menu items and repoint the site's home menu item to attacker-controlled destinations.

Affected Products

JoomShaper SP Page Builder Free (versions 4.0.0 through 6.9.0)
JoomShaper SP Page Builder Pro (versions 4.0.0 through 6.9.0)
Joomla installations running the affected extension versions

Discovery Timeline

2026-09-14 - CVE-2026-81566 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-81566

Vulnerability Analysis

The vulnerability arises because SP Page Builder's add-to-menu functionality calls the Joomla com_menus item model save() method directly. In Joomla's MVC architecture, authorisation checks for menu operations live in the com_menus controller, not in the model layer. By bypassing the controller, SP Page Builder skips the standard permission logic entirely.

The only check applied by the extension is core.edit on com_sppagebuilder. A user with that single permission and no rights whatsoever on com_menus can invoke the routine and create menu items. The record identifier is taken from the submitted jform[menuid] field, so the same routine can be used to overwrite existing menu entries by supplying their IDs.

The home flag is read back from the database and preserved during the save. This means an attacker can repoint the site's home menu item to a different target while it remains flagged as the home item, effectively hijacking the front page for any visitor.

Root Cause

The root cause is a design flaw in how SP Page Builder invokes the menu subsystem. Direct use of the model bypasses the authorisation boundary enforced by the controller. This is a classic broken access control pattern where trust in the caller replaces explicit permission verification at the sink.

Attack Vector

Exploitation is network-based and requires an authenticated account holding core.edit on com_sppagebuilder. The attacker submits a crafted request to the add-to-menu endpoint with a jform[menuid] value corresponding to an existing menu item. The vulnerability produces no confidentiality impact, but modifies menu integrity across the Joomla site. See the JoomShaper SP Page Builder product page for version details.

Detection Methods for CVE-2026-81566

Indicators of Compromise

Unexpected changes to menu items in the Joomla #__menu table, particularly modifications to the home menu item's link or component_id fields.
New menu entries created by user accounts that do not hold com_menus permissions.
HTTP requests to SP Page Builder endpoints containing jform[menuid] parameters referencing existing menu IDs.

Detection Strategies

Audit the Joomla action logs for menu creation or modification events attributed to users without com_menus permissions.
Compare current menu configurations against known-good backups to identify unauthorised changes to the home item or navigation entries.
Inspect web server logs for POST requests to SP Page Builder controllers containing menuid form fields.

Monitoring Recommendations

Enable Joomla's User Actions Log with menu component events included, and forward logs to a central SIEM.
Alert on any change to the record where home = 1 in the #__menu table outside of scheduled administrator activity.
Monitor privileged extension endpoints for anomalous parameter usage such as unexpected jform[menuid] submissions.

How to Mitigate CVE-2026-81566

Immediate Actions Required

Upgrade SP Page Builder (Free or Pro) to a version later than 6.9.0 that includes the vendor fix.
Review all accounts granted core.edit on com_sppagebuilder and remove the permission from users who do not require it.
Restore the home menu item and any modified navigation entries from a trusted backup if tampering is confirmed.

Patch Information

JoomShaper addresses the issue in releases following 6.9.0. Refer to the JoomShaper SP Page Builder product page for the current release and vendor advisory. Apply the update through the Joomla Extensions Manager and verify the installed version afterwards.

Workarounds

Restrict core.edit on com_sppagebuilder to a minimal set of trusted administrators until the patched version is deployed.
Place the Joomla administrator directory behind an additional authentication layer such as HTTP basic auth or IP allow-listing.
Enforce integrity monitoring on the #__menu database table to detect unauthorised writes in near real time.

bash

# Verify installed SP Page Builder version via Joomla CLI
php cli/joomla.php extension:list | grep -i "sp page builder"

# Example: enumerate users holding core.edit on com_sppagebuilder
# Run inside the Joomla database
SELECT u.id, u.username
FROM #__users u
JOIN #__user_usergroup_map m ON m.user_id = u.id
JOIN #__assets a ON a.name = 'com_sppagebuilder'
WHERE JSON_EXTRACT(a.rules, '$."core.edit"') IS NOT NULL;