What is the CVSS score of CVE-2026-66488?

CVE-2026-66488 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Gridbox CVE-2026-66488

EUVD-2026-50335 MEDIUM

Improper Authorization (CWE-285)

2026-07-29 Joomla

GHSA-263x-7287-228p

Authentication Bypass Gridbox Extension For Joomla Balbooa Com

5.3

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible payment bypass with no auth or interaction required; impact is integrity-only (unauthorized order completion), with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 21:37 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

5.3 (MEDIUM)

CVE Published

Jul 29, 2026 - 13:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2

AnalysisAI

Payment bypass in Gridbox (Joomla extension by balbooa.com) versions 1.0.0 through 2.20.1 allows unauthenticated remote attackers to circumvent payment enforcement due to improper authorization checks (CWE-285), enabling acquisition of paid content or order completion without payment. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely exploitable with no authentication or user interaction required. No public exploit has been identified at time of analysis, though SSVC designates the attack as automatable with partial technical impact, raising concerns about systematic financial fraud at scale.

Technical ContextAI

Gridbox is a page builder and e-commerce extension for the Joomla CMS developed by balbooa.com, identified by CPE cpe:2.3:a:balbooa.com:gridbox_extension_for_joomla:*:*:*:*:*:*:*:*. The root cause is CWE-285 (Improper Authorization), a logic-level flaw where the extension fails to adequately verify that a legitimate payment has been completed before granting access to gated content or fulfilling an order. This class of vulnerability typically arises when server-side authorization logic trusts client-supplied parameters or skips validation steps in the order completion flow, rather than enforcing payment state server-side. It is notably distinct from authentication bypass - the issue is post-authentication authorization within the purchasing workflow. The mysites.guru advisory reference discloses this as one of 23 critical vulnerabilities in the Gridbox extension, suggesting systemic security debt in the codebase.

RemediationAI

Upgrade Gridbox to version 2.20.2 or later immediately, as this is the vendor-confirmed fix version per EUVD and the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-66488. The vendor product page at https://www.balbooa.com/gridbox should be consulted for the current release. As an interim compensating control pending upgrade, administrators can disable payment-gated features within Gridbox configuration or restrict HTTP access to checkout and order-completion endpoints via Joomla's access control layer or web server rules - note this will disrupt legitimate purchasing workflows and must be tested against site functionality before deployment. Given the mysites.guru disclosure of 23 critical vulnerabilities in this extension, a full security review of the Gridbox installation is warranted alongside patching, and organizations should monitor for unauthorized order completions in transaction logs dating back to initial deployment.