The Balbooa Gridbox extension for Joomla, a popular drag-and-drop page builder, has been found to contain a severe vulnerability identified as CVE-2026-65888. This critical flaw allows attackers to easily take control of user accounts on affected websites, including administrator accounts. The vulnerability stems from a weak point in the social login method within the Gridbox software, making it possible for unauthorized individuals to log in as any existing user on a target site without needing a password.<\/p>\n
This is part of a larger set of 23 vulnerabilities discovered in Gridbox, which also included a pre-authentication remote code execution flaw. The urgency to address these issues is extremely high, as reports indicate that several of these vulnerabilities, including this account takeover method, are actively being exploited by malicious actors in the wild.<\/p>\n
Product Name:<\/strong> Balbooa Gridbox for Joomla<\/p>\n Published Date:<\/strong> July 29, 2026<\/p>\n Severity:<\/strong> Critical<\/p>\n Status:<\/strong> Analyzed<\/p>\n All versions of Balbooa Gridbox for Joomla prior to 2.20.2<\/strong> are affected by this vulnerability. It is crucial to note that while version 2.20.2 was the initial comprehensive fix, subsequent updates (up to 2.20.4.0) have addressed additional security concerns. Therefore, users should update to the latest available secure version, currently 2.20.4.0 or newer<\/strong>.<\/p>\n The vulnerability has been officially analyzed and confirmed. The Joomla CNA (CVE Numbering Authority) has assigned CVE-2026-65888, marking it with a Critical severity and confirming active exploitation. This means that attackers are already using this flaw to compromise websites.<\/p>\n CVE-2026-65888 carries a CVSS score of 9.8, categorizing it as a Critical<\/strong> severity vulnerability. A critical rating signifies that the flaw is easily exploitable and can lead to significant compromise of the affected system. In this specific case, an attacker can gain unauthorized access to any user account, including those with elevated privileges like site administrators. Such an account takeover can lead to complete control over the website, data breaches, and further attacks on the hosting environment.<\/p>\n Given the critical nature and active exploitation of this vulnerability, immediate action is required:<\/p>\n https:\/\/mysites.guru\/blog\/gridbox-23-critical-vulnerabilities\/<\/p>\n https:\/\/www.balbooa.com\/gridbox<\/p>\n https:\/\/www.cve.org\/CVERecord?id=CVE-2026-65888<\/p>\n https:\/\/www.cve.org\/CVERecord?id=CVE-2026-65884<\/p>\n https:\/\/www.cve.org\/CVERecord?id=CVE-2026-65887<\/p>\n https:\/\/www.cve.org\/CVERecord?id=CVE-2026-65885<\/p>\n https:\/\/www.cve.org\/CVERecord?id=CVE-2026-61425<\/p>\n https:\/\/mysites.guru\/blog\/gridbox-2-20-4-0-security-fixes\/<\/p>\n https:\/\/mysites.guru\/blog\/gridbox-author-sql-injection\/<\/p>\n https:\/\/mysites.guru\/blog\/gridbox-critical-authentication-bypass\/<\/p>\n","protected":false},"excerpt":{"rendered":" The Balbooa Gridbox extension for Joomla, a popular drag-and-drop page builder, has been found to contain a severe vulnerability identified as CVE-2026-65888. This critical flaw allows attackers to<\/p>\n","protected":false},"author":17,"featured_media":2649,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1334,1335,1333,1323,980],"class_list":["post-4351","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-accounttakeover","tag-authenticationbypass","tag-criticalvulnerability","tag-gridbox","tag-joomla"],"yoast_head":"\nAffected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
\n
References<\/h2>\n