Which versions of Gridbox are affected by CVE-2026-61425?

The Balbooa Gridbox extension for Joomla contains a critical privilege escalation vulnerability (CVE-2026-61425, CVSS 9.4) allowing authenticated users to gain full administrative control of the CMS.

How to fix or mitigate CVE-2026-61425?

Within 24 hours, identify all Joomla instances running Balbooa Gridbox and disable the extension if possible or immediately restrict access via IP allowlisting; audit recent administrative account activity for unauthorized modifications. Within 7 days, complete a full inventory of affected systems and implement enhanced monitoring for admin account changes, CMS configuration modifications, and administrative panel logins; deploy Web Application Firewall (WAF) rules targeting exploitation attempts. Within 30 days, upgrade to a patched version of Balbooa Gridbox when the vendor releases a fix, or migrate to alternative Joomla extensions; establish a 48-hour patching SLA for all vendor security updates.

Gridbox CVE-2026-61425

Q: What is the CVSS score of CVE-2026-61425?

CVE-2026-61425 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-46068 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-07-20 security@joomla.org

GHSA-825m-333c-p679

Authentication Bypass

9.4

CVSS 4.0 · Vendor: joomla

Severity by source

Vendor (joomla) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable and low complexity; PR:L because an authenticated lower-privileged user bypasses to admin; S:C as the extension flaw yields control of the whole Joomla authority, with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (joomla).

CVSS VectorVendor: joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 19:31 vuln.today

CVE Published

Jul 20, 2026 - 19:17 cve.org

CRITICAL 9.4

DescriptionCVE.org

The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access.

AnalysisAI

Authentication/authorization bypass in the Balbooa Gridbox extension for Joomla allows an already-authenticated user to escalate to full administrative control of the CMS. CWE-288 indicates the flaw stems from an alternate-path or channel that skips proper authorization checks; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor-assigned CVSS 4.0 score of 9.4 reflects the total compromise of confidentiality, integrity, and availability that admin takeover implies.

Technical ContextAI

Gridbox is a commercial page-builder / theme-building extension for the Joomla CMS, developed by Balbooa (balbooa.com). Joomla extensions run inside the Joomla application context and inherit its access-control model based on user groups and view/administrative permissions. The root cause is classified as CWE-288, Authentication Bypass Using an Alternate Path or Channel - the extension exposes functionality (likely an administrative controller, task, or endpoint) that can be reached without passing through the intended authorization gate, so a session that already holds some lower level of authenticated access can invoke privileged operations reserved for administrators. No CPE strings were provided, so exact affected version boundaries cannot be enumerated from the input.

RemediationAI

No vendor-released patch version was identified in the provided data, so upgrade to the latest Gridbox release from Balbooa and monitor https://www.balbooa.com/gridbox and the writeup at https://mysites.guru/blog/gridbox-critical-authentication-bypass/ for a confirmed fixed version; apply it as soon as it is published. As interim compensating controls: restrict access to the Joomla administrator area and the Gridbox controllers by IP allow-listing at the web server or firewall (trade-off: breaks admin access for remote/mobile staff), tighten Joomla user-group permissions so no low-trust accounts exist that could leverage the bypass, review recently created or elevated administrator accounts for signs of abuse, and consider temporarily disabling/unpublishing the Gridbox extension if it is not business-critical (trade-off: any Gridbox-built pages will stop rendering). A WAF rule blocking direct requests to Gridbox administrative tasks can reduce exposure but may cause false positives against legitimate admin use.