Balbooa Gridbox for Joomla, social-login method logs the caller in as any user (CVSS 4.0 10.0), exploit maturity Attacked; fixed in 2.20.2

Balbooa's response to CVE-2026-61425, the cookie flaw fixed in 2.20.1, was to commission the same researcher to audit the whole component, and that audit found 23 further vulnerabilities in this one extension (mySites.guru, 2026-07-29). The delta that matters is that 2.20.1 is itself vulnerable to a worse flaw than the one it fixed, and that flaw is being exploited.

CVE-2026-65884 carries a CVSS 4.0 base score of 10.0 for a reason that requires no exploit skill at all: the registration handler adds the usergroup IDs supplied in the request to the default group rather than replacing them, so an anonymous visitor can register an ordinary account and place it directly into an administrator group. The researcher describes the defect precisely: the registration handler "adds the default group to whatever groups the visitor asks for, instead of replacing them," so "anyone can register a normal account and place themselves straight into an administrator group" (mySites.guru, 2026-07-29). CVE-2026-65885, scored 9.4, is an authenticated arbitrary file upload, and it becomes remote code execution when chained with the first because the attacker can create the account the upload requires. Both published records give the affected range as 1.0.0 to 2.20.1, every version the extension has ever shipped up to the fix, and both are marked with an exploit maturity of attacked and an urgency of red by the Joomla CNA that assigned them (mySites.guru, 2026-07-29).

Exploitation is not an inference. The researcher reports holding server access logs showing the exploitation requests arriving and describes 92 planted administrator accounts on a single connected Joomla site, created in batches from 27 July, with usernames following one generator's pattern of a fixed prefix plus a few hex characters paired to matching webmail addresses (mySites.guru, 2026-07-29). Balbooa's own release page corroborates attack traffic indirectly, referring to a recent increase in automated attacks and telling customers who added custom web-server rules to block the recent attacks on Gridbox endpoints to remove them after updating (Balbooa, 2026-07-29).

Getting to a fixed build took three attempts, which is itself operationally relevant for anyone who applied an interim Gridbox update this month. The researcher's account of the coordinated-disclosure process records that the vendor's first proposed fix left several reported findings live, including an anonymous SQL injection returning password hashes that had been patched at only one of several identical reachable entry points, and that the second closed that and the actively-exploited routes but still left a forgeable payment-gateway callback signature and a SQL injection reachable by a low-privilege authenticated user (mySites.guru, 2026-07-29). Only 2.20.2, released 2026-07-29, closes all of it, and the vendor states the build was given to the reporting researcher for independent verification before release (Balbooa, 2026-07-29). The remaining 21 findings are described only by shape, with nine further CVE IDs reserved but unpublished, so the public picture of this component's exposure is not yet complete.

Detection. Both halves of the chain leave records in places most Joomla operators already keep. For the privilege escalation, the artifact is a user account whose administrator-group membership was established at creation time rather than by a later administrative change, visible in the user table and in Joomla's own action logs as a registration event that produced an elevated account, with no corresponding admin action. Cluster it by timing: automated abuse of this flaw produces accounts in batches minutes apart, not the trickle of genuine sign-ups. For the upload half, the signal is a file appearing in a web-reachable directory with a server-executable extension, written by the web server user, followed by requests to that path from a small number of sources; in web-server access logs, look for POST requests to the extension's registration and upload endpoints from addresses with no prior browsing history on the site.

Triage: a public Joomla site with open registration collects spam accounts constantly, so a new unrecognised user is not the signal. The discriminator is the group membership: ordinary registration spam lands in the default registered-users group and stays there, while these accounts sit in an administrator group from the moment they were created. Any self-registered account holding administrative rights on a Gridbox site should be treated as planted rather than misconfigured.

All eleven CVE records the Joomla CNA assigned to the Gridbox 2.20.2 batch have now published. Every one lists Gridbox 1.0.0 to 2.20.1 as affected, seven are rated Critical, and four carry the exploit maturity Attacked with an urgency of Red (mySites.guru, revised since). Two of the four are new to this entry and both are CVSS 4.0 10.0: CVE-2026-65887, a password-reset method that resets any account's password and logs the attacker in as that user, Super Users excepted, and CVE-2026-65888, a social-login method that logs the caller in as any user on the site. mySites.guru reports the exploitation as seen in server access logs and on compromised sites, and the Joomla Security Strike Team reported at least three of the issues exploited on 29 July. The fix for that exploited set is Gridbox 2.20.2. On a site that ran an earlier build while internet-facing, unexpected password resets and social-login sessions for existing accounts belong in the same review as the attacker-registered administrator accounts described above.

Balbooa has shipped three releases since 2.20.2. Version 2.20.2.3 (10 August) is titled "Bug Fixes and Security Hardening" and touches the media manager's access controls, internal path validation and the password-recovery flow, with no CVE, severity or affected range. mySites.guru has not audited it and notes that three of those areas overlap flaws recorded as fixed in 2.20.2 (mySites.guru, revised since). Version 2.20.3.1 (21 September) fixes an unauthenticated time-based blind SQL injection in the front-end blog author parameter, which went into a database query without being cast to a number. Every build below 2.20.3.1 is affected, 2.20.3 and 2.20.2.3 included, and there is no CVE or CVSS score yet. The vendor filed it as security hardening, and the flaw was reported by Studio Przy Lesie and identified by CERT Polska (mySites.guru, 2026-09-21). No exploitation of it has been reported. The version to be on then was 2.20.3.1; the later update below moves it to 2.20.4.2. In web-server access telemetry, requests to the Gridbox blog view whose author value is not a plain number are the signal, and by inference from the time-based technique, ones that take several seconds to answer are the likelier successful probes. A numeric author filter is normal browsing.

Balbooa released Gridbox 2.20.4.2 on 2026-10-27 with two security fixes rated Critical, for the versions 2.20.4.1 and earlier (Balbooa, 2026-10-27). CVE-2026-102788 is in the sort-by URL parameter of store and category post lists and CVE-2026-102789 is a missing permission check on the editor task that loads blog posts (mySites.guru, 2026-10-27); Balbooa's fixes are a strict allowlist validation for the sort-by parameter and a user edit-level check on the editor task (Balbooa, 2026-10-27). mySites.guru says the sort value previously went into the ORDER BY part of the database query and reads the second flaw as a second anonymous route to the same query. mySites.guru reports that the Joomla CNA scores both CVSS 4.0 9.3 and lists every release from 1.0.0 to 2.20.4.1 as affected, and that only two PHP files differ between 2.20.4.1 and 2.20.4.2, one per fix (mySites.guru, 2026-10-27).

mySites.guru reads both flaws as read-side, although the CNA's vector also rates integrity and availability High: an anonymous visitor can extract the Joomla user table, with its password hashes, and every other table the site's extensions created. mySites.guru says about 95% of the Gridbox sites it monitors ran an affected version on the morning of the release, that sites on the Joomla 3 line stop at Gridbox 2.17.0.2, which has no fix for this year's flaws, and that there is no public report of exploitation yet (mySites.guru, 2026-10-27). Nothing here is reported exploited, unlike the July batches above; the version to be on is now 2.20.4.2.

Balbooa released Gridbox version 2.20.5.0 on 2026-11-04 with four security fixes for version 2.20.4.2 and earlier, rated High and filed as CVE-2026-105607, CVE-2026-107129, CVE-2026-107130 and CVE-2026-107903, without saying which identifier belongs to which flaw (Balbooa, 2026-11-04). mySites.guru describes the worst as a front-end task for removing temporary comment and review attachments that, in version 2.20.4.2, needed no login and did not check that the file it was told to delete stayed inside the uploads folder; the other three are a second file deletion flaw on form submissions and two stored cross-site scripting flaws in the comment and review output (mySites.guru, 2026-11-04). mySites.guru says there is no public report of exploitation and that about 92% of the Gridbox sites it monitors are affected (mySites.guru, 2026-11-04).