The vulnerability arises from the Page Builder CK extension’s failure to enforce access restrictions on its frontend page list view. As a result, any user who can load the list view can see information about the pages that exist on the Joomla site, potentially revealing sensitive page titles, URLs, or even unpublished content. The weakness is a classic improper access control flaw (CWE‑284).

Affected installations are those running the joomlack.fr Page Builder CK component for Joomla, specifically versions earlier than 3.6.2. The vulnerability is tied to the extension and does not affect the core Joomla framework itself.

Based on the description, it is inferred that the attack vector is the publicly accessible frontend page list view, requiring no authentication. Because the flaw is exposed through the public web interface, attackers only need to access the site’s address to view the page list, and no authentication is required. The CVSS score is 9.1, indicating a high severity. The EPSS score of <1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog, implying no known confirmed exploitation. Nonetheless, the impact is significant for organizations that expose the frontend or rely on the page list for display, so the flaw should be addressed promptly.