EUVD-2026-50356
GHSA-84gf-cfmw-8qqq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Joomla site running Gridbox < 2.20.2
-
DeliverySend crafted request to socialLogin endpoint
-
ExploitAssert target user identity without valid token
-
ExecutionReceive authenticated session as victim
-
PersistLog in as administrator
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Gridbox extension (version < 2.20.2) is installed on a Joomla site and that its social-login capability - the vulnerable socialLogin method - is reachable on the front end. The attacker must supply or know the target account identifier (username/email) to impersonate, and any account, including administrators, can be targeted. Limiting factors: sites without Gridbox installed, running 2.20.2+, or with the social-login feature disabled/removed are not exploitable. Otherwise, per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special complexity are needed against an affected deployment. |
| Impact | This is a genuine top-priority issue rather than a high-score-but-low-impact case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and full high impact to confidentiality, integrity and availability on both vulnerable and subsequent systems - consistent with total account/site takeover. The vector's threat metric E:A ('Attacked') suggests exploitation activity may have been observed, but this CVE is NOT listed in CISA KEV in the provided data, so active exploitation cannot be confirmed here - treat the E:A signal as unverified. No EPSS score was supplied and no public POC is referenced, so exploitation probability cannot be quantified from the input. The combination of trivial attack requirements and admin-level takeover potential means defenders should treat this as urgent regardless of the missing EPSS/KEV confirmation. |
| Exploit ScenarioDerived | An attacker who knows or guesses a target username (e.g., the site administrator) sends a crafted request to Gridbox's social-login endpoint, invoking the socialLogin method with the victim's identity. The method issues an authenticated Joomla session for that account without valid provider verification, granting the attacker administrator access and full control of the site. No credentials, user interaction, or prior authentication are required, making targeted or opportunistic takeover straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Authentication bypass in the Gridbox page-builder extension for Joomla (versions before 2.20.2) lets remote unauthenticated attackers take over any account on the target site. The flaw resides in the extension's socialLogin method, which fails to properly verify identity and allows an actor to authenticate as any chosen user - including administrators. Rated CVSS 4.0 10.0 (CWE-284 Improper Access Control); no public exploit is identified at time of analysis, though the vendor product page and a third-party research blog document Gridbox critical issues.
RemediationAI
Upgrade the Gridbox extension to version 2.20.2 or later (the first fixed release), which resolves the socialLogin authentication bypass - this is the primary and authoritative fix per the vendor. Until the update can be applied, disable or remove the Gridbox social-login feature so the vulnerable socialLogin method cannot be invoked (trade-off: legitimate users lose social sign-in and must use standard Joomla credentials), or take the extension offline / restrict the affected front-end endpoint via web-server rules or a WAF (trade-off: may break Gridbox-rendered pages). After patching, force a global session invalidation and password reset and audit Joomla user and session logs for unexpected logins to administrator or privileged accounts, since a successful takeover leaves no obvious front-door trace. Consult https://www.balbooa.com/gridbox and the research write-up https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/ for advisory details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gridbox is a commercial drag-and-drop page-builder/website-builder extension for the Joomla CMS, published by balbooa.com (CPE cpe:2.3:a:balbooa.com:gridbox_extension_for_joomla). The vulnerability is an Improper Access Control weakness (CWE-284) in the extension's socialLogin method - the routine intended to authenticate users via a social/OAuth-style login flow. Because the method does not correctly bind or validate the asserted identity (e.g., trusting a client-supplied user identifier instead of cryptographically verifying the social provider's assertion/token), it can be coerced into issuing an authenticated Joomla session for an arbitrary target account. Social-login flows are a recurring source of account-takeover bugs precisely when the server accepts an attacker-controllable identity parameter rather than verifying the provider's response.
Know when Gridbox Extension For Joomla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
Remote, unauthenticated, no-interaction takeover of any account including admin; S:C because bypassing the auth boundary compromises the whole Joomla site beyond the extension.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.
Executive ViewAI
The Gridbox page-builder extension for Joomla contains a critical authentication bypass vulnerability (CVE-2026-65888, CVSS 10.0) allowing unauthenticated remote attackers to assume control of any user account, including administrator privileges. Organizations running Gridbox versions prior to 2.20.2 face immediate risk of complete site takeover and unauthorized administrative access. This vulnerability presents an urgent threat to operational security and regulatory compliance for any Joomla deployment using this extension.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or uninstall the Gridbox extension entirely; implement Web Application Firewall (WAF) rules to block unauthenticated access to page-builder endpoints; restrict administrative interface access to trusted IP ranges; mandate multi-factor authentication for all administrative accounts; increase authentication logging verbosity and implement real-time alerting on failed authentication attempts or privilege elevation; consider isolating affected Joomla instances from critical infrastructure until remediation is complete.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Gridbox Extension For Joomla
View allUnauthenticated account takeover in the Gridbox page-builder extension for Joomla (versions before 2.20.2) allows any re
Privilege escalation in the balbooa Gridbox extension for Joomla (versions before 2.20.2) lets unauthenticated actors se
Arbitrary file upload in the Balbooa Gridbox page-builder extension for Joomla (versions before 2.20.2) lets an authenti
Unauthenticated SQL injection in the Balbooa Gridbox extension for Joomla before 2.20.4.2 allows remote attackers to inj
Missing authorization in the Balbooa Gridbox extension for Joomla (versions 1.0.0 through 2.20.4.1) allows unauthenticat
Arbitrary file read in the Balbooa Gridbox page-builder extension for Joomla (all versions before 2.20.2) lets remote un
Arbitrary recursive directory deletion in the Gridbox extension for Joomla (versions before 2.20.2) lets remote unauthen
Unauthenticated SQL injection in Balbooa's Gridbox extension for Joomla (versions before 2.20.2) lets remote attackers i
Cross-site request forgery (CSRF) in the Gridbox extension for Joomla before 2.20.4.0 allows unauthenticated attackers t
Cross-site request forgery in balbooa Gridbox, a page-builder extension for Joomla, allows attackers to forge state-chan
Path traversal in the Gridbox extension for Joomla (versions before 2.20.4.0) allows unauthenticated remote attackers to
Stored cross-site scripting in the Gridbox Joomla extension by balbooa.com allows attackers to inject persistent malicio
Exploit-DB