I found a problem with the permission "Manage menus Create, update and delete menus" inside a group permissions. Due to this much more users can add menu even though they should not be allowed to.
I have set the permissions so only admin (group internal and external) can create a new menu inside a group ("Add new menu"). But instead every group member with "Manage menu items" permission is able to add new menus to a group.
At least group_content_menu 3.0.2 and 3.0.3 seem to have this issue.
Check for correct permission in GroupContentMenuRouteProvider.php. I've included a patch.
Active
3.0
Code
I have the same problem with 3.0.5. My customer wants to have exactly one group menu per group and only admins should be allowed to create/delete groups and their related menus, but group members with specific group roles (group admin, group content manager) should be able to create/edit/delete group menu items.