Which versions of Gridbox are affected by CVE-2026-65888?

The Gridbox page-builder extension for Joomla contains a critical authentication bypass vulnerability (CVE-2026-65888, CVSS 10.0) allowing unauthenticated remote attackers to assume control of any…

How to fix or mitigate CVE-2026-65888?

Within 24 hours: audit all Joomla installations to identify instances running Gridbox versions before 2.20.2; immediately disable or uninstall the extension, or restrict network access to page-builder functionality via WAF/firewall rules if removal is not immediately feasible. Within 7 days: implement compensating controls including IP-based access restrictions to administrator panels, force password resets for all administrative accounts, enable detailed authentication logging, and configure alerts for failed authentication attempts on admin accounts. Within 30 days: monitor official Gridbox and Joomla vendor advisories for patch releases; establish testing procedures in staging environments and plan controlled deployment of security updates once available.

Gridbox CVE-2026-65888

Q: What is the CVSS score of CVE-2026-65888?

CVE-2026-65888 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red. EPSS exploitation probability: 0.2%.

EUVD-2026-50356 CRITICAL

Improper Access Control (CWE-284)

2026-07-29 Joomla

GHSA-84gf-cfmw-8qqq

Authentication Bypass Gridbox Extension For Joomla

10.0

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red

vuln.today AI

10.0 CRITICAL

Remote, unauthenticated, no-interaction takeover of any account including admin; S:C because bypassing the auth boundary compromises the whole Joomla site beyond the extension.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 15:16 vuln.today

CVE Published

Jul 29, 2026 - 13:59 cve.org

CRITICAL 10.0

DescriptionCVE.org

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.

AnalysisAI

Authentication bypass in the Gridbox page-builder extension for Joomla (versions before 2.20.2) lets remote unauthenticated attackers take over any account on the target site. The flaw resides in the extension's socialLogin method, which fails to properly verify identity and allows an actor to authenticate as any chosen user - including administrators. Rated CVSS 4.0 10.0 (CWE-284 Improper Access Control); no public exploit is identified at time of analysis, though the vendor product page and a third-party research blog document Gridbox critical issues.

Technical ContextAI

Gridbox is a commercial drag-and-drop page-builder/website-builder extension for the Joomla CMS, published by balbooa.com (CPE cpe:2.3:a:balbooa.com:gridbox_extension_for_joomla). The vulnerability is an Improper Access Control weakness (CWE-284) in the extension's socialLogin method - the routine intended to authenticate users via a social/OAuth-style login flow. Because the method does not correctly bind or validate the asserted identity (e.g., trusting a client-supplied user identifier instead of cryptographically verifying the social provider's assertion/token), it can be coerced into issuing an authenticated Joomla session for an arbitrary target account. Social-login flows are a recurring source of account-takeover bugs precisely when the server accepts an attacker-controllable identity parameter rather than verifying the provider's response.

RemediationAI

Upgrade the Gridbox extension to version 2.20.2 or later (the first fixed release), which resolves the socialLogin authentication bypass - this is the primary and authoritative fix per the vendor. Until the update can be applied, disable or remove the Gridbox social-login feature so the vulnerable socialLogin method cannot be invoked (trade-off: legitimate users lose social sign-in and must use standard Joomla credentials), or take the extension offline / restrict the affected front-end endpoint via web-server rules or a WAF (trade-off: may break Gridbox-rendered pages). After patching, force a global session invalidation and password reset and audit Joomla user and session logs for unexpected logins to administrator or privileged accounts, since a successful takeover leaves no obvious front-door trace. Consult https://www.balbooa.com/gridbox and the research write-up https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/ for advisory details.