CVE-2026-65887

CriticalCVSS 10.0

Published: 29/07/2026(UTC)Updated: 31/07/2026(UTC)Translated: 29/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an unauthenticated attacker to reset any user's password (excluding super admins). This allows logging in and acting as those users.

Risk Assessment

An attacker can take over user accounts (except super admins), gaining unauthorized access to the system and data.

Recommendation

Update Gridbox to version 2.20.2 or later.

Original NVD description (English source)

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.