What is the CVSS score of CVE-2026-65947?

CVE-2026-65947 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Gridbox are affected by CVE-2026-65947?

balbooa Gridbox, a widely-deployed Joomla page-builder extension, contains a cross-site request forgery (CSRF) vulnerability affecting administrators in versions prior to 2.20.2.

How to fix or mitigate CVE-2026-65947?

Within 24 hours: identify all Joomla installations using balbooa Gridbox and determine current versions; prioritize any installations running affected versions (prior to 2.20.2). Within 7 days: implement Web Application Firewall (WAF) rules to block cross-origin requests to the Joomla admin console; review administrator access logs for suspicious state-changing actions; enforce CSRF token validation and Same-Site cookie attributes in Joomla configuration. Within 30 days: monitor vendor advisories for available security updates to balbooa Gridbox; evaluate alternative page-builder extensions with active security support; establish continuous monitoring of administrator sessions and configuration changes.

Gridbox CVE-2026-65947

EUVD-2026-50357 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-29 Joomla

GHSA-78h3-8rrv-7frx

CSRF Gridbox Extension For Joomla

7.3

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Classic CSRF needs no attacker privileges (PR:N) but requires tricking an authenticated admin (UI:R); admin-level actions justify C:H/I:H, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 21:34 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

7.3 (HIGH)

CVE Published

Jul 29, 2026 - 14:00 cve.org

HIGH 7.3

CVE Published

Jul 29, 2026 - 14:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

AnalysisAI

Cross-site request forgery in balbooa Gridbox, a page-builder extension for Joomla, allows attackers to forge state-changing admin actions in versions prior to 2.20.2 by tricking an authenticated administrator into loading a malicious page. The flaw spans multiple CSRF vectors in the admin interface and carries high confidentiality and integrity impact (CVSS 7.3), though EPSS is only 0.10% and no public exploit identified at time of analysis. SSVC rates exploitation as 'none' with 'total' technical impact, indicating serious potential consequence but no observed weaponization.

Technical ContextAI

The affected component is the balbooa Gridbox extension for Joomla (CPE cpe:2.3:a:balbooa.com:gridbox_extension_for_joomla), a drag-and-drop content/page builder installed as a Joomla administrator component. The root cause is CWE-352 (Cross-Site Request Forgery): admin-interface endpoints perform sensitive state changes without validating an anti-CSRF token tied to the user's session, so the server cannot distinguish a legitimate admin-initiated request from one forged by a third-party site. Because Joomla admin actions execute with the privileges of the logged-in back-end user, a successful forgery inherits those elevated capabilities. This was reported as part of a broader batch of Gridbox findings (see mysites.guru advisory referencing multiple Gridbox vulnerabilities).

RemediationAI

Vendor-released patch: upgrade the Gridbox extension for Joomla to version 2.20.2 or later, which is the fixed release per the advisory. Obtain the update from the vendor (https://www.balbooa.com/gridbox) and apply it through the Joomla Extensions Manager. If immediate patching is not possible, reduce exposure by restricting access to the Joomla administrator interface (e.g., IP allow-listing or a VPN in front of /administrator), enforcing that administrators do not browse untrusted sites in the same session as the admin panel, and shortening admin session lifetimes so forged requests are less likely to hit an active session; note these controls add operator friction and do not remove the underlying missing-token flaw. Review the mysites.guru advisory (https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/) for related Gridbox issues that may warrant the same upgrade.