All vulnerabilities
CVE-2026-102789

Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2

balbooa.com Gridbox extension for JoomlaApplications & CMS
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check.

Text from CVE List

Affected versions 1

  • Gridbox extension for Joomlaaffected: 1.0.0-2.20.4.1CVE List

References 1