Which versions of Gridbox are affected by CVE-2026-65887?

The Gridbox page-builder extension for Joomla contains a critical authentication bypass that enables any external actor to reset user passwords and take over administrator and editor accounts,…

How to fix or mitigate CVE-2026-65887?

Within 24 hours, identify all Joomla deployments running Gridbox, determine installed versions, and immediately disable the extension to eliminate the attack vector; simultaneously enable comprehensive audit logging of all password reset and authentication attempts. Within 7 days, implement interim technical defenses while awaiting vendor patch: restrict Joomla administrator panel access by IP whitelist or mandatory VPN requirement, deploy Web Application Firewall rules to block resetPassword method calls, and enforce multi-factor authentication on all administrator and editor role accounts. Within 30 days, upgrade to patched Gridbox version 2.20.2 or later once released by vendor, re-enable extension with enhanced monitoring, conduct forensic review of account access logs for any evidence of unauthorized activity during the vulnerability exposure period, and forcefully reset all administrator and editor account passwords as a recovery measure.

Gridbox CVE-2026-65887

Q: What is the CVSS score of CVE-2026-65887?

CVE-2026-65887 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red. EPSS exploitation probability: 0.2%.

EUVD-2026-50355 CRITICAL

Improper Access Control (CWE-284)

2026-07-29 Joomla

GHSA-f53f-94jh-jchq

Authentication Bypass Gridbox Extension For Joomla Balbooa Com

10.0

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red

vuln.today AI

9.8 CRITICAL

Unauthenticated network access with no interaction or complexity (AV:N/AC:L/PR:N/UI:N); arbitrary account takeover yields full C/I/A impact, and S:U as impact stays within Joomla's authorization scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 15:16 vuln.today

CVE Published

Jul 29, 2026 - 13:58 cve.org

CRITICAL 10.0

DescriptionCVE.org

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.

AnalysisAI

Unauthenticated account takeover in the Gridbox page-builder extension for Joomla (versions before 2.20.2) allows any remote attacker to reset the password of arbitrary user accounts through the exposed resetPassword method, then log in and act as those users. Super administrator accounts are explicitly out of scope, but all other roles - including regular administrators, editors, and managers - can be seized. The maximum CVSS 4.0 base score of 10.0 reflects unauthenticated, low-complexity, network-reachable exploitation; no public exploit has been identified at time of analysis, though the CVSS threat metrics flag automatability and exploitation evidence.

Technical ContextAI

Gridbox is a commercial drag-and-drop page-builder/component extension for the Joomla CMS produced by balbooa.com. The root cause is classified as CWE-284 (Improper Access Control): the resetPassword method is reachable without authentication and performs no authorization check binding the caller to the target account, so the password-reset routine can be invoked against any account identifier rather than only the requesting user's own account. Because Joomla extensions run inside the CMS session and privilege model, a successful reset lets the attacker authenticate as the victim and inherit that user's Joomla privileges. The affected component is identified by CPE cpe:2.3:a:balbooa.com:gridbox_extension_for_joomla, covering all versions prior to the fixed 2.20.2 release.

RemediationAI

Vendor-released patch: upgrade Gridbox to version 2.20.2 or later, which remediates the unauthenticated resetPassword access-control flaw. Apply the update through Joomla's extension manager as the primary and definitive fix. Until the upgrade can be applied, restrict reachability of the vulnerable endpoint: place the Joomla site behind a WAF or web-server rule that blocks unauthenticated requests to the Gridbox password-reset action, or temporarily unpublish/disable the Gridbox component if the site can operate without it - noting the trade-off that disabling it will break any front-end pages built with Gridbox. As a detective/response control, force a password reset for all non-super-admin accounts and audit recent logins and account changes for signs of takeover. Refer to the vendor at https://www.balbooa.com/gridbox and the advisory writeup at https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/.