Which versions of Joomla Gridbox are affected by CVE-2026-65884?

The balbooa Gridbox extension for Joomla (prior to version 2.20.2) contains a critical flaw allowing unauthenticated internet users to instantly gain administrative site access without tools,…

How to fix or mitigate CVE-2026-65884?

Within 24 hours, identify all Joomla installations running balbooa Gridbox prior to version 2.20.2 and immediately disable the extension; audit user accounts for suspicious administrative group assignments created in the past 90 days and revoke unauthorized accounts. Within 7 days, implement network-level access controls on Joomla registration endpoints using WAF rules or IP restrictions, enable comprehensive logging of user registration and group assignment events, and review logs for exploitation attempts. Within 30 days, upgrade balbooa Gridbox to version 2.20.2 or later on all systems, or evaluate replacement Joomla user management extensions; test the upgrade in a non-production environment and verify the vulnerability is remediated before production deployment.

Joomla Gridbox CVE-2026-65884

Q: What is the CVSS score of CVE-2026-65884?

CVE-2026-65884 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red. EPSS exploitation probability: 0.2%.

EUVD-2026-50299 CRITICAL

Improper Access Control (CWE-284)

2026-07-29 Joomla

GHSA-5mfv-p7rj-5xgx

Privilege Escalation Authentication Bypass Gridbox Extension For Joomla

10.0

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red

vuln.today AI

10.0 CRITICAL

Unauthenticated remote registration with no interaction (AV:N/AC:L/PR:N/UI:N); creating admin accounts crosses a privilege boundary into the CMS security authority, so S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 13:00 vuln.today

CVE Published

Jul 29, 2026 - 12:09 cve.org

CRITICAL 10.0

DescriptionCVE.org

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions.

AnalysisAI

Privilege escalation in the balbooa Gridbox extension for Joomla (versions before 2.20.2) lets unauthenticated actors self-register accounts while supplying arbitrary Joomla usergroup IDs, so an attacker can create an account placed directly into an administrative usergroup. Because the registration handler trusts client-supplied group assignments, exploitation grants full site takeover with no prior credentials. No public exploit has been identified at time of analysis, but the trivial network-based nature makes it high priority.

Technical ContextAI

Gridbox is a commercial drag-and-drop page-builder/site-builder extension for the Joomla CMS, distributed by balbooa.com and identified by CPE cpe:2.3:a:balbooa.com:gridbox_extension_for_joomla. The flaw sits in the extension's user registration method, which accepts the target Joomla usergroup ID from client input and uses it when creating the account instead of forcing a fixed low-privilege group. This is a classic CWE-284 (Improper Access Control) root cause: an access-control decision (which usergroup a new user joins) is delegated to attacker-controlled data. In Joomla, usergroups map directly to Access Control Levels, so being placed into a Super Users or Administrator group confers full backend and configuration control.

RemediationAI

Upgrade the Gridbox extension to version 2.20.2 or later, which is the first release that addresses the insecure usergroup handling (Vendor-released patch: 2.20.2). Until the update can be applied, restrict or disable public user registration through Gridbox and via Joomla's global Users configuration (Allow User Registration set to No), and audit the site's user table for recently created accounts assigned to Administrator or Super Users groups, removing any unauthorized entries - note that disabling registration blocks legitimate self-signup and is a temporary control only. As an additional safeguard, place the site behind a WAF rule that inspects registration POST parameters for usergroup/group-ID fields, accepting that custom parameter names may require tuning. Verify remediation and obtain the exact advisory from the vendor at https://www.balbooa.com/gridbox.