CVE-2026-61425
The Joomla extension Gridbox, versions earlier than 1.6.0, has an authentication bypass that lets an attacker log in as an administrator without knowing a password. This flaw gives full control over the site, allowing changes to content, extensions, and data.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Joomla sites that use the Gridbox extension version 1.5.x or earlier. Site administrators who have not upgraded to 1.6.0 or later are affected.
Real-world impact
An attacker could gain administrative access, modify or delete site content, install malicious extensions, and potentially steal or expose sensitive data.
Why this severity
The CVSS score of 9.4 reflects that the vulnerability is network‑reachable, requires low effort, and grants an attacker high privileges, compromising confidentiality, integrity, and availability of the Joomla site.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 20, 2026 · 13d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 10d agoAdvisory updatedThe NVD record was last revised.