CVE-2026-102789
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Missing authorization check in the editor controller task in the Joomla Gridbox extension (balbooa.com) before version 2.20.4.2. The EditorController::getBlogPosts() method reads the order parameter and invokes getBlogPosts(), omitting the GridboxHelper::checkUserEditLevel() check used by other tasks in the controller.
Risk Assessment
A user without appropriate privileges may access editor functionality, potentially leading to unauthorized content changes. Impacts the integrity of the Joomla-based site.
Recommendation
Update the Gridbox extension to version 2.20.4.2 or later. Verify user account permissions in the Joomla site.
Other vulnerabilities in Gridbox
See all- CVE-2026-102788Critical
Unauthenticated SQL injection vulnerability in the Joomla Gridbox extension (balbooa.com) before version 2.20.4.2. On store product list pages, the sort-by URL parameter value is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(); when it does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without allowlist validation.
- CVE-2026-65888Critical
The Joomla extension Gridbox before version 2.20.2 has an account takeover vulnerability. The socialLogin method allows an attacker to log in as any user on the target site.
- CVE-2026-65887Critical
Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an unauthenticated attacker to reset any user's password (excluding super admins). This allows logging in and acting as those users.
- CVE-2026-65890Critical
Joomla Extension Gridbox below version 2.20.2 has multiple SQL injection vectors allowing an unauthenticated attacker to inject SQL queries.
- CVE-2026-65884Critical
Joomla Extension Gridbox below version 2.20.2 has a privilege escalation vulnerability. The registration method allows users to provide usergroup IDs, enabling an unauthenticated attacker to register an account with administrative permissions.
- CVE-2026-61425Critical
The Joomla extension Gridbox versions below 1.6.0 contains an authentication bypass vulnerability. An attacker can gain full administrative access without providing valid credentials.
- CVE-2026-102784High
The Joomla extension Gridbox (by balbooa.com) below version 2.20.4.0 contains a CSRF vulnerability in the language installation feature because the addLanguage action does not require POST and does not validate the session token.
- CVE-2026-102783Medium
Path Traversal vulnerability in Joomla extension Gridbox (before 2.20.4.0) in the showImage action allows reading files from sibling directories if image decoding fails, due to insufficient containment checks.
- CVE-2026-65947High
Joomla Extension Gridbox from balbooa.com versions < 2.20.2 has various CSRF vectors in the admin interface.
- CVE-2026-65886High
Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an unauthenticated attacker to read arbitrary files via the photo viewer.
Original NVD description (English source)
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS