CVE-2026-65888 CRITICAL

CVE-2026-65888: Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2

Vendor Balbooa.com

Product Gridbox extension for Joomla

Weakness CWE-284

Published July 29, 2026

Last update August 1, 2026

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red

What the vulnerability does

01Description

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.

Explanation of Vulnerability in Simple Terms

02Summary

The Gridbox extension for Joomla contains an access control flaw that allows unauthenticated attackers to read, modify, or delete sensitive data and disrupt site operations. The vulnerability requires only network access and can be exploited without user interaction. All versions from 1.0.0 through 2.20.1 are affected.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete sensitive data; disrupt site availability without authentication.

Potential impact on your site

04Site Impact

Attackers can access private content, alter site data, or take the site offline without logging in.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

July 29, 2026 CVE published

August 1, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-65888 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/284.html AskarLabs — CWE-284 write-up Improper Access Control

Related vulnerabilities

Identifiers

CVE CVE-2026-65888

CWE CWE-284

CVSS 10.0 / CRITICAL

Affected versions