CVE-2026-65887
A Joomla extension called Gridbox, used in many websites, has a flaw that lets anyone reset any user’s password without authentication. The flaw exists in all versions older than 2.20.2. If exploited, an attacker could take over normal user accounts.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Websites running the Joomla Gridbox extension version 2.19.x or earlier. Site owners and administrators who rely on that extension for content management.
Real-world impact
An attacker could reset passwords for any user account (except super admins) and then log in as those users, gaining the same access rights as the victim.
Why this severity
The CVSS score of 10 reflects that the vulnerability is easy to exploit (no authentication, no user interaction), and the impact is complete compromise of user accounts, with high confidentiality, integrity, and availability impact.
What to do about it
- 01Check the current Gridbox version in your Joomla installation.
- 02Download the latest Gridbox package (2.20.2 or newer) from the official extension site.
- 03Install or replace the old extension with the new one via Joomla’s Extension Manager.
- 04Verify that the update was applied and that the version number shows 2.20.2 or higher.
- 05Optionally, reset any compromised user passwords.
NVD description indicates vulnerability fixed in Gridbox 2.20.2 or later.
Timeline
- Jul 29, 2026 · 21h agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 20h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.