Balbooa Gridbox CVE-2026-65890

Exploitation targets a Joomla installation with the Balbooa Gridbox extension (version below 2.20.2) installed and enabled, reached over the network with no authentication or user interaction (PR:N/UI:N). The one limiting factor signaled by the CVSS vector is AT:P (Attack Requirements: Present) - a specific but unspecified precondition must hold for the injection to succeed, which the source data does not detail and which should be confirmed with the vendor advisory; it may relate to a particular Gridbox feature, endpoint, or content-rendering path being active. Sites not running Gridbox, or running 2.20.2+, are not exploitable.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction - a classic high-risk profile - yielding a 9.2 Critical score with high confidentiality (VC:H) and high subsequent-system impact (SC:H/SI:H/SA:H). The one mitigating signal is AT:P (Attack Requirements: Present), meaning some deployment- or timing-dependent precondition exists that a fully wormable flaw would not have; the source data does not specify what that requirement is, so it should be verified with the vendor. No EPSS score, no SSVC decision, no KEV listing, and no confirmed POC were provided, so exploitation-in-the-wild cannot be asserted. On balance this is a genuine priority for any Joomla site running Gridbox - unauthenticated SQLi is routinely mass-scanned and weaponized - but the absence of EPSS/KEV data means widespread active exploitation is unconfirmed rather than proven.

A remote attacker with no account crafts an HTTP request to a Gridbox endpoint, inserting SQL syntax into one of the vulnerable parameters, and uses UNION-based or blind injection to dump the Joomla #__users table. With extracted administrator password hashes or session tokens, the attacker escalates to full CMS takeover. No public exploit is identified at time of analysis, but SQLi of this class is trivially automatable once the vulnerable parameter is known.