What Happened?

A critical issue was identified in our large Joomla site where menu items from multiple menus are unpublished in bulk, despite actions being performed only within a filtered menu view.

In our production incident, all menu items were unpublished except those belonging to the currently filtered menu, requiring a full database restore from backup to recover the site. This was due to the home menu item also being unpublished as it wasn't part of the currently filtered menu.

It was then reproduced multiple times in local and test versions of our site as well as then being reproduced in a clean joomla install.

Environment

• Joomla version: reproduced in 5.4.3 and 5.4.5
• Database: MySQL / MariaDB
• Reproduced on a clean Joomla installation with no additional extensions installed

Impact

• Home menu item was unpublished causing the site to fully fail
• Mass unpublishing of all menu items except the menu selected in the filter
• Site navigation effectively broken
• Site rendered inaccessible
• Recovery required database restoration

Steps to Reproduce

Video is uploaded here for demo of reproducing issue. This was taken on a clean joomla 5.4.5 install with no extensions installed and around 2000 menu items created and distributed across 5 menus in nested groups of over 5 levels.

Joomla Menu Bug

1. Set up a clean Joomla 5.4.5 installation.
2. Create approximately 10 different menu types.
3. Create around 1500 menu items, distribute them across the 10 menus.
   • Include deep nesting (more than 5 levels).
4. Navigate to Menus → Manage → Menu Items.
5. Apply filters:
   • Filter by a single menu
   • Set Max Levels = 2
6. Within the filtered menu view:
   7. Drag a menu item up or down in the tree to change its position
   8. Immediately unpublish its newly-adjacent sibling item using the unpublish tick icon, note this has to be within a fraction of a second (likely when the previous database query updating the siblings was still occurring)

Expected Behaviour

• Only the selected menu item (or items explicitly selected) within the filtered menu should be unpublished.
• Menu items belonging to other menus should remain unaffected.

Actual Behaviour

• All menu items outside the currently filtered menu are unpublished.
• Only menu items visible under the active filter remain published.

Additional Comments

• The issue appears to be triggered by a combination of:
  • Large menu structure, with varying levels of depth
  • Menu filtering
  • Limited tree depth display (Max Levels)
  • Drag-and-drop reordering
  • Immediate publish state changes of the sibling to the reordered item

Potentially due to re-order query getting mixed up with unpublish action in the filtered view.

The bug is reproducible and not limited to a single site or dataset.