Gridbox EUVD-2026-50355

No special conditions - remote unauthenticated exploitation against default installations of Gridbox for Joomla prior to version 2.20.2, achieved by invoking the exposed resetPassword method. The only requirement is a network-reachable Joomla site running a vulnerable Gridbox version with the component's password-reset functionality accessible. Limiting factors: super administrator accounts are explicitly excluded from the reset, so an attacker cannot directly seize the top-level Joomla super-user role through this flaw; exploitation also requires that the Gridbox extension be installed and enabled (patched versions 2.20.2+ are not affected).

This is a genuine high-priority issue rather than an inflated high-CVSS finding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes fully remote, unauthenticated, no-interaction exploitation with high confidentiality, integrity, and availability impact, and the threat/supplemental metrics reinforce urgency: AU:Y (automatable), E:A (attacked/exploitation evidence per the CVSS threat metric), and U:Red (provider urgency Red). No EPSS score, no CISA KEV listing, and no confirmed POC were supplied in the input, so the E:A/U:Red signals originate from the reporting party (Joomla) rather than from CISA - meaning active exploitation is asserted at the CVSS-metric level but is NOT independently confirmed as CISA KEV. The one meaningful limiter is that super-admin accounts are excluded from the reset, capping the maximum privilege an attacker can directly steal; however, taking over lower-privileged admin/editor accounts is often sufficient for content defacement, further privilege escalation, or lateral movement.

An attacker sends a crafted unauthenticated HTTP request to the Gridbox resetPassword method, specifying the account of a target administrator or editor and setting a password they control. Because no authorization check ties the request to the caller, the reset succeeds, and the attacker logs into Joomla as that user to modify content, install malicious extensions, or pivot toward higher privileges. Given AV:N/AC:L/PR:N/UI:N and the automatable (AU:Y) nature of the flaw, the attack requires no user interaction and is easily scriptable across many sites.