Gridbox CVE-2026-102789

The target must have the balbooa.com Gridbox extension for Joomla installed at a version below 2.20.4.2 (1.0.0-2.20.4.1). Exploitation requires reaching the EditorController getBlogPosts task via the Joomla front controller; per the supplied vector (PR:N/UI:N/AC:L/AT:N) no authentication, user interaction or special configuration is needed, so default installations are exposed. The only practical limiting factors are presence of the vulnerable extension and a pre-2.20.4.2 version; what the exposed getBlogPosts response and the attacker-controlled 'order' parameter yield beyond unauthorized blog-post reads is not described in the available sources.

Signals conflict and should be weighed carefully. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable flaw requiring no privileges, no user interaction and low complexity, and the vuln.today Decision label is 'act_now' - both arguing for priority remediation. However, the EPSS score is only 0.32% (24th percentile), the CVE is NOT in CISA KEV, and no exploit or PoC reference is present, so there is no evidence of active or imminent mass exploitation; the urgency is driven by the unauthenticated-access profile, not by observed exploitation. There is also tension between the supplied impact metrics (VC:H/VI:H/VA:H → 9.3) and the described mechanism: the evidence only states that EditorController::getBlogPosts() omits the GridboxHelper::checkUserEditLevel() authorization check (CWE-284) while reading the 'order' parameter and returning blog posts, which on its face is an access-control/information-disclosure issue rather than a confirmed integrity/availability compromise - the high integrity and availability ratings are not substantiated by the available text and should be verified with the vendor. Net: a genuine unauthenticated authorization-bypass worth patching promptly given the trivial attack profile, but the low EPSS and absence of KEV/PoC suggest it is not currently under widespread exploitation.

A remote, unauthenticated attacker sends a crafted request to the Joomla front controller invoking the Gridbox EditorController getBlogPosts task, which never calls checkUserEditLevel(). Because low attack complexity and no authentication are required, the attacker retrieves blog-post data (and supplies an attacker-controlled 'order' parameter) that should have been restricted to editors. No public exploit or PoC reference is provided in the input.