Alex Joseph
The Balbooa Gridbox extension for Joomla, a popular drag-and-drop page builder, has been found to contain a severe vulnerability identified as CVE-2026-65888. This critical flaw allows attackers to easily take control of user accounts on affected websites, including administrator accounts. The vulnerability stems from a weak point in the social login method within the Gridbox software, making it possible for unauthorized individuals to log in as any existing user on a target site without needing a password.
This is part of a larger set of 23 vulnerabilities discovered in Gridbox, which also included a pre-authentication remote code execution flaw. The urgency to address these issues is extremely high, as reports indicate that several of these vulnerabilities, including this account takeover method, are actively being exploited by malicious actors in the wild.
CVE Details
Product Name: Balbooa Gridbox for Joomla
Published Date: July 29, 2026
Severity: Critical
Status: Analyzed
Affected Products
All versions of Balbooa Gridbox for Joomla prior to 2.20.2 are affected by this vulnerability. It is crucial to note that while version 2.20.2 was the initial comprehensive fix, subsequent updates (up to 2.20.4.0) have addressed additional security concerns. Therefore, users should update to the latest available secure version, currently 2.20.4.0 or newer.
Current Status
The vulnerability has been officially analyzed and confirmed. The Joomla CNA (CVE Numbering Authority) has assigned CVE-2026-65888, marking it with a Critical severity and confirming active exploitation. This means that attackers are already using this flaw to compromise websites.
Severity Level
CVE-2026-65888 carries a CVSS score of 9.8, categorizing it as a Critical severity vulnerability. A critical rating signifies that the flaw is easily exploitable and can lead to significant compromise of the affected system. In this specific case, an attacker can gain unauthorized access to any user account, including those with elevated privileges like site administrators. Such an account takeover can lead to complete control over the website, data breaches, and further attacks on the hosting environment.
Possible Solutions
Given the critical nature and active exploitation of this vulnerability, immediate action is required:
- Update Immediately: Ensure your Balbooa Gridbox extension is updated to version 2.20.4.0 or later. This is the version that includes fixes for the full range of vulnerabilities. You can update via Joomla’s Extensions updater or by downloading the latest version from your Balbooa account.
- Perform a Backup: Before applying any updates to a live site, always create a full backup of your website. This ensures you have a recovery point if anything goes wrong during the update process.
- Check for Compromise: After updating, it is vital to check your site for any signs of compromise. Look for:
- New or unknown administrator accounts. Tools like “rogue admin checks” can help identify these.
- Suspicious PHP files in unexpected directories, which might indicate a web shell.
- Recently modified or unusual files.
- Rotate Credentials: If your site was running an affected version, assume your Joomla secret and other critical credentials might have been exposed. Change all administrator passwords and other sensitive access keys.
- Consider Disabling: If an immediate update is not possible, consider temporarily disabling the Gridbox extension on high-value sites, if your website’s functionality can tolerate it, until the patch is applied.
References
https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/
https://www.balbooa.com/gridbox
https://www.cve.org/CVERecord?id=CVE-2026-65888
https://www.cve.org/CVERecord?id=CVE-2026-65884
https://www.cve.org/CVERecord?id=CVE-2026-65887
https://www.cve.org/CVERecord?id=CVE-2026-65885
https://www.cve.org/CVERecord?id=CVE-2026-61425
https://mysites.guru/blog/gridbox-2-20-4-0-security-fixes/
https://mysites.guru/blog/gridbox-author-sql-injection/
https://mysites.guru/blog/gridbox-critical-authentication-bypass/
