Critical· 10official fix available
CVE-2026-65888
A Joomla extension called Gridbox has a flaw that lets attackers log in as any user. The problem is in the socialLogin method and affects all versions older than 2.20.2. Updating the extension fixes the issue.
publishedJul 29, 2026
last modifiedJul 30, 2026
sourcesNVD
severity · cvss
10
critical · how bad it is
exploitation · epss
n/a
chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 28, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Joomla sites using the Gridbox extension version 2.19.x or earlier. Site administrators and users of those sites.
02
Real-world impact
An attacker could impersonate any site user, gaining access to private data, posting content, or performing administrative actions.
03
Why this severity
The CVSS score of 10 reflects that the vulnerability is easy to exploit, requires no user interaction, and gives an attacker full control over user accounts, making it a critical risk.
04
What to do about it
official fix available
recommended steps
- 011. Update the Gridbox extension to version 2.20.2 or later.
- 022. Verify the update and restart the site if necessary.
NVD description
05
Timeline
- Jul 29, 2026 · 21h agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 20h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Attack requirementsNone
Privileges requiredNone
User interactionNone needed
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →