Which versions of Balbooa Gridbox are affected by CVE-2026-65890?

Balbooa's Gridbox extension for Joomla contains a critical unauthenticated SQL injection vulnerability (CVSS 9.2) that enables remote attackers to directly access the Joomla database and extract user…

How to fix or mitigate CVE-2026-65890?

Within 24 hours: Conduct immediate inventory of all Joomla installations running Gridbox extension; identify affected versions and prioritize production systems for assessment. Within 7 days: Disable the Gridbox extension on all systems running versions prior to 2.20.2, or implement compensating controls such as WAF rules blocking SQL injection patterns and network access restrictions. Within 30 days: Monitor Balbooa's security advisories for the release of patched version 2.20.2 or later; upon availability, thoroughly test in staging environment and deploy to all production Joomla instances.

Balbooa Gridbox CVE-2026-65890

Q: What is the CVSS score of CVE-2026-65890?

CVE-2026-65890 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-50337 CRITICAL

SQL Injection (CWE-89)

2026-07-29 Joomla

GHSA-729v-8mm2-88pw

SQLi Gridbox Extension For Joomla

9.2

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Unauthenticated network SQLi with no user interaction gives AV:N/AC:L/PR:N/UI:N; database read exposure sets C:H while integrity/availability impact is limited (I:L/A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 14:23 vuln.today

CVE Published

Jul 29, 2026 - 13:56 cve.org

CRITICAL 9.2

DescriptionCVE.org

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.

AnalysisAI

Unauthenticated SQL injection in Balbooa's Gridbox extension for Joomla (versions before 2.20.2) lets remote attackers inject malicious SQL through multiple untrusted input vectors without any login. The flaw carries a CVSS 4.0 base score of 9.2 (Critical) and can expose database contents including Joomla user credentials and session data. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature makes it a strong patching priority.

Technical ContextAI

Gridbox is a drag-and-drop page-builder/content extension for the Joomla CMS distributed by balbooa.com (CPE cpe:2.3:a:balbooa.com:gridbox_extension_for_joomla). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable request parameters are concatenated into SQL statements executed against Joomla's backing database (typically MySQL/MariaDB) without proper parameterization or escaping. Because Joomla extensions run within the site's PHP application context and share the CMS database, an injection here reaches the full #__users, session, and configuration tables. The advisory notes 'multiple SQLi vectors,' indicating more than one unsanitized endpoint or parameter rather than a single isolated sink.

RemediationAI

Upgrade Gridbox to version 2.20.2 or later, which is the fixed release implied by the 'Gridbox < 2.20.2' affected range; obtain it from the vendor at https://www.balbooa.com/gridbox and confirm the exact patched build against the vendor changelog before deploying. If immediate patching is not possible, place the Joomla site behind a WAF with SQL-injection signatures tuned to Gridbox request parameters, restrict or disable the Gridbox extension until upgraded (which will break pages built with it), and enforce least-privilege on the database account Joomla uses so a successful injection cannot reach tables outside the CMS schema. Additional context is available at https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/. Because credential and session tables may already be exposed, rotate Joomla admin passwords and secrets after patching.