Joomla extension file-upload RCE wave

Joomla third-party-extension wave status: the wave crossed from disclosed to evidenced this week — server access logs showing exploitation requests, and 92 planted administrator accounts on one live site

UPDATE · originally covered Joomla third-party-extension vulnerability wave status: the mySites.guru campaign added a new technique class this week — a client-supplied cookie accepted as proof of identity, giving anonymous Super User access (2026-07-26)

the prior weekly recorded this wave broadening beyond file-upload RCE into a cookie-trusted-as-identity auth bypass, with no member yet confirmed exploited in the wild. That changed this week.

A follow-on source-code audit of Balbooa Gridbox, commissioned by the vendor after its earlier authentication-bypass disclosure, found 22 further vulnerabilities in that one component — and the researcher is explicit that the flaw this entry leads on was not among them: "Number 23 is not from the audit. It surfaced alongside the active exploitation" (mySites.guru, 2026-07-29). Its mechanism is a single line of logic: "the registration handler adds the default group to whatever groups the visitor asks for, instead of replacing them. So anyone can register a normal account and place themselves straight into an administrator group." (mySites.guru, 2026-07-29). Chained with an authenticated arbitrary file upload, that becomes end-to-end unauthenticated remote code execution. The affected range is total — the researcher notes that both CNA records "list the affected range as 1.0.0 to 2.20.1, which is every Gridbox release there has ever been up to the fix. And both set the exploit maturity to Attacked with an urgency of Red, which is the CVE record's own way of recording that this is being used against real sites rather than sitting as a theoretical risk." (mySites.guru, 2026-07-29), with the complete fix in Gridbox 2.20.2 (Balbooa, 2026-07-29). Note that 2.20.1 was itself the fix for the prior weekly's cookie-forgery flaw, so a site that patched in response to that disclosure is still exposed to these.

What moves the wave's status is the evidence class rather than the severity. Previous members were disclosed, sometimes with a public proof-of-concept, occasionally KEV-listed later. This one arrives with logs: "we have the server access logs showing the exploitation requests arriving, and connected sites where the accounts are already planted. On one connected Joomla site our rogue admin check is holding 92 planted accounts right now" (mySites.guru, 2026-07-29). Ninety-two planted administrator accounts on a single site is not opportunistic scanning; it is an automated campaign that has already run.

Cadence did not slow. VulnCheck disclosed an unauthenticated PHP object injection in Aimy Captcha-Less Form Guard, where the anti-spam token is deserialized with no signature and the XOR keystream needed to forge it ships in the same page (VulnCheck, 2026-07-30). And mySites.guru reported four vulnerabilities in JoomShaper SP Page Builder — 6.7.1 closes five in total, the fifth being one the discloser states it neither reported nor tested — the sharpest of them being an ORDER BY injection whose only guard is a Joomla anti-CSRF token that Joomla issues to every anonymous visitor — making it effectively pre-authentication SQL injection returning the entire Joomla database, password hashes included (mySites.guru, 2026-07-27).

Builds on: 2026-07-31/balbooa-gridbox-cve-2026-65884-anon-admin-registration-rce · 2026-08-01/aimy-captcha-joomla-cve-2026-65883-object-injection-rce · 2026-08-02/sp-page-builder-cve-2026-65766-preauth-sqli-mail-relay

Every authentication bypass disclosed this week came from code accepting an attacker-supplied value as proof of identity — the check ran, it just validated the wrong thing

Six disclosures inside one week, in products that share no code and no vendor, all failed the same way. None of them forgot to check. Each one checked something the attacker got to choose.

The clearest statement of the class is Apache's. The FAB auth manager's Azure AD OAuth login path decoded the OAuth-supplied ID token with the verify_signature parameter defaulted to False, so a token presented with no signature — or with alg:none — authenticated the requester as whichever user it named, the Admin role included; Apache fixed it in apache-airflow-providers-fab 3.7.3 by flipping that default, and states the Authentik path already defaulted to True (Apache Airflow security team, 2026-07-28). The token was validated. What was not validated was whether anyone had signed it.

Check Point's is the same shape one layer up in an enterprise management plane. Rapid7 found the vulnerable method preferred a caller-supplied Secure Internal Communication distinguished name over the DN bound to the authenticated peer certificate, so a client that replayed the management server's own DN was accepted as that identity with no client certificate at all, then used the resulting session to request an SSO token claiming system_admin (Rapid7 Labs, 2026-07-28). Rapid7 also records why the exposure was broad rather than a corner case: "exploitation requires network access to the Management Server and for a Trusted Clients configuration that does not restrict GUI clients, which in our testing was a default setting" (Rapid7 Labs, 2026-07-28). SolarWinds disclosed a straightforward instance of the class in Web Help Desk — CVE-2026-28323, an unauthenticated SAML 2.0 authentication bypass it scores CVSS 9.8, whose only stated precondition is that SAML 2.0 authentication is enabled, fixed in 2026.2.1 (SolarWinds, 2026-07-23).

The three Joomla extension disclosures show the class reaching its most trivial expression, and the Balbooa Gridbox pair is the only member of this group with server-log-level exploitation evidence — though not the only one exploited, since Rapid7 records the Check Point flaw as having been reported exploited in the wild as a zero-day at the time of disclosure (Rapid7 Labs, 2026-07-28). In Balbooa Gridbox, "the registration handler adds the default group to whatever groups the visitor asks for, instead of replacing them. So anyone can register a normal account and place themselves straight into an administrator group" (mySites.guru, 2026-07-29) — the request was processed correctly, and the requested privilege level was simply honoured. In JoomShaper's SP Page Builder, a request value reaches the ORDER BY clause of the Dynamic Content endpoint's query with only a Joomla anti-CSRF token in front of it — and because Joomla issues that token to every anonymous visitor on page load, a scripted attacker fetches one and replays it, making the injection effectively pre-authentication and returning the whole Joomla database including password hashes (mySites.guru, 2026-07-27). And in Aimy Captcha-Less Form Guard, the anti-spam token is base64-decoded, run through a repeating-key XOR and handed to unserialize() with no signature and no allowed_classes — while the plugin renders a ciphertext for that same keystream in every protected form, so the key is recoverable and the object forgeable (VulnCheck, 2026-07-30).

Triage: these produce authentication successes rather than failures, so a failed-login baseline will not surface any of them. The discriminators are internal inconsistency in the successful event — a session established with no corresponding client-certificate validation, an ID token accepted with an alg:none or absent signature, an account whose privilege group was set in the same transaction that created it rather than by a later administrative action, or a database-heavy request arriving with a freshly-minted anonymous session token and no prior authenticated activity. On the Joomla estate specifically, an administrator-group member whose account creation timestamp matches its group assignment timestamp is the artifact Gridbox exploitation leaves behind.

Builds on: 2026-07-29/cve-2026-59243-airflow-fab-azure-ad-jwt-signature-bypass · 2026-07-29/check-point-cve-2026-16232-sic-dn-substitution-root-cause · 2026-08-01/solarwinds-web-help-desk-cve-2026-28323-saml-auth-bypass · 2026-07-31/balbooa-gridbox-cve-2026-65884-anon-admin-registration-rce · 2026-08-02/sp-page-builder-cve-2026-65766-preauth-sqli-mail-relay · 2026-08-01/aimy-captcha-joomla-cve-2026-65883-object-injection-rce

CVE-2026-65766 and CVE-2026-65879 — SP Page Builder for Joomla: a CSRF token Joomla hands to anonymous visitors is the only guard on an ORDER BY injection, plus a shipped-in-source shared secret that opens a mail relay

This is a recovery published by the 2026-08-02 weekly quality audit: the disclosure landed inside the audit window and no entry covered it.

The reason CVE-2026-65766 matters is the shape of the control that was supposed to stop it. Two scores are in circulation and the discloser says which one to use: "The CNA scored the pre-authentication SQL injection 9.2 Critical. We scored it 8.7 High", and "Where the two differ, the CNA’s number is the one that travels with the CVE." (mySites.guru, 2026-07-27) — so this entry carries the CNA figures. The Dynamic Content endpoint's tag-sort feature concatenates the request's sort direction value directly into the query's ORDER BY clause — a position no prepared statement can parameterise — and the only thing in front of that endpoint is a Joomla CSRF token. Joomla issues a valid token to every visitor on page load, anonymous ones included, so an attacker's script fetches a page, lifts the token and replays it; mySites.guru states the flaw is "protected only by a CSRF token, which Joomla hands to every anonymous visitor, so it is effectively pre-auth. An attacker could read the entire database, password hashes included" (mySites.guru, 2026-07-27). The discloser confirmed it with a time-based blind proof on its own test install. A CSRF token is an anti-forgery control, not an authentication control, and any extension that treats one as an authorisation gate has the same defect class regardless of vendor.

The second flaw, CVE-2026-65879, is a design decision rather than an oversight. The ajax_contact and form_builder contact-form addons protect the configured recipient address with a signature, but as the discloser puts it, "The contact-form addons protected the recipient address with a secret that was hardcoded identically into every copy of the extension" — so the secret is public to anyone who downloads the extension, the signature is forgeable, and an attacker sets an arbitrary recipient and a spoofed sender. The outbound mail then leaves the victim's own domain and mail server, which is what makes this a deliverability and reputation problem rather than a nuisance: the spam or phishing carries the site's authenticated sending identity. Two further issues need only a low-privilege author account — an unescaped SQL injection in the media manager's search and date filters (CVE-2026-65877, CVSS 4.0 8.2), and a media-delete action that removes a request-supplied path with no traversal guard (CVE-2026-65878, CVSS 4.0 8.3), letting an author delete configuration.php or a protective .htaccess. A fifth identifier against the same versions, CVE-2026-65876, is a second unauthenticated SQL injection — through the catid parameter of the loadMoreArticles endpoint, scored CVSS 4.0 9.2 by the CNA — which the discloser explicitly did not report and did not test, but which 6.7.1 also fixes: "If you are working out what 6.7.1 actually fixed, the answer is five issues, not four."

Two things put this above the routine extension-update cycle for a public-sector estate running Joomla. First, the mechanics: an anonymous, scriptable request that returns the full user table needs no exploitation signal to force a timeline. Second, the base rate for this specific extension — mySites.guru notes it reported "the June 2026 unauthenticated icon-upload zero-day that was being exploited in the wild and fixed in 6.6.2" in the same product, and describes SP Page Builder as "one of the most widely installed page builders in the ecosystem". A product whose last unauthenticated flaw was exploited before the fix shipped does not get the benefit of the doubt on the next one.

Triage: the SQL injection produces web-server access-log entries that look entirely legitimate — a valid CSRF token, an ordinary Dynamic Content endpoint path, HTTP 200. The discriminators are in the parameter and the pattern rather than the endpoint: sort-direction values that are not asc or desc, unusually long or syntactically complex query-string values on that endpoint, and above all a long run of near-identical requests from one source with response-time variation rather than response-content variation, which is the signature of a time-based blind extraction. A single request is unremarkable; a few thousand of them against one endpoint from one address, each differing by a character, is the finding. For the mail-relay flaw, the artefact is in the mail logs rather than the web logs: messages leaving the site's mail server whose recipient domain has no relationship to the site's own audience.