Gridbox CVE-2026-102784

Requires an authenticated Joomla user holding the core.tools permission (typically an administrator) to be socially engineered into issuing a crafted GET request to the Gridbox PagesController addLanguage action. The vulnerability exists because the controller's session-token trait validates the Joomla CSRF token only on HTTP POST, and addLanguage neither forces POST nor re-checks the token, reading url and zip from generic request input - so a GET bypasses token validation entirely. Affects default configurations of Gridbox < 2.20.4.0. Limiting factors: the victim must already be logged in with core.tools and must actively trigger the request (UI:P), meaning no fully unattended or unauthenticated-only exploitation.

This is a CWE-352 CSRF flaw in the balbooa.com Gridbox page-builder extension for Joomla (versions < 2.20.4.0). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, score 8.7) is internally consistent with the description: the attack is remote and low-complexity, requires no attacker authentication (PR:N) because it abuses the victim's own session, but does require user interaction (UI:P) since a privileged user must be lured into issuing the request. The core.tools permission check applies to the victim, not the attacker, so it does not mitigate CSRF. No EPSS score, CISA KEV listing, SSVC decision data, or POC was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 8.7 rating is a theoretical-impact score, not a signal of in-the-wild activity. The high VC/VI/VA impacts are plausible because the addLanguage action fetches a url/zip and installs it, which can lead to arbitrary extension/code installation. Net: a credible, genuinely high-impact issue worth patching, but exploitation hinges on social-engineering a specific administrator, so real-world risk is tempered relative to a fully unauthenticated RCE. The only confirming source is the Joomla report; no independent vendor advisory text, EPSS, or exploit data was provided to corroborate urgency.

An attacker crafts a malicious web page or email link containing a GET request to the Gridbox PagesController addLanguage action, embedding attacker-controlled url and zip parameters. Because the session-token trait only validates the token on POST, a logged-in Joomla administrator (holding core.tools) who visits the link silently triggers installation of an attacker-supplied language/extension package. No public exploit code was provided in the intelligence, but the attack is straightforward to construct given the described GET/POST token gap.