Joomla Gridbox CVE-2026-65884

Exploitation requires that the Gridbox extension (version below 2.20.2) is installed and that its user-registration functionality is reachable/enabled, since the vulnerable code path is the registration method that accepts a client-supplied usergroup ID. Given the CVSS AV:N/AC:L/PR:N/UI:N vector, no authentication, no user interaction, and no special network position are needed beyond HTTP access to the registration endpoint. The main limiting factors are therefore deployment-specific: the site must actually run Gridbox and permit registration through it; environments that disable public/self-registration or have already upgraded to 2.20.2 are not exploitable.

All primary signals point to maximum severity: the CVSS 4.0 base vector AV:N/AC:L/AT:N/PR:N/UI:N with high vulnerable-system confidentiality, integrity and availability impact yields a 10.0, meaning remote, low-complexity, unauthenticated exploitation requiring no user interaction. The supplied vector also carries threat/supplemental metrics E:A (exploitation 'Attacked') and AU:Y (automatable), which would indicate active/automatable exploitation; however, the input contains no CISA KEV flag and no POC flag, so this is classified as no public exploit identified at time of analysis and the E:A marker cannot be independently corroborated from the data provided - treat the automatable/attacked hints as unverified. No EPSS score was provided, so probabilistic exploitation likelihood cannot be compared. The combination of zero prerequisites and full administrative outcome makes this a genuine top-priority issue rather than an inflated high-CVSS-but-low-real-risk case, with the only real limiter being the deployment footprint of the specific paid extension.

An unauthenticated attacker locates a Joomla site running Gridbox with registration enabled, submits a crafted registration request that includes an administrative usergroup ID (e.g. Super Users) in the account-creation parameters, and immediately obtains a working administrator account. They then log into the Joomla backend to install a malicious extension or template override, achieving full server-side code execution and site takeover. No public POC is documented in the provided data, but the low complexity means such a request is trivial to craft.