CVE Catalog
CVE-2026-65888
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk0.25%
16th percentile - higher than 16% of all known CVEs
Summary
The Joomla extension Gridbox before version 2.20.2 has an account takeover vulnerability. The socialLogin method allows an attacker to log in as any user on the target site.
Risk Assessment
An attacker can take over an administrator or other user account, gaining full access to the Joomla site and potentially infecting it with malware.
Recommendation
Update the Gridbox extension to version 2.20.2 or later, which fixes this vulnerability.
Original NVD description (English source)
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.