CVE-2026-65884 is a critical (CVSS 9.8) privilege escalation in Gridbox for Joomla. Before version 2.20.2, the registration method accepted user group IDs from the requester, so an anonymous visitor could create an account with administrative permissions. mySites.guru reports active exploitation. Update Gridbox and audit your user list.
What's affected
- Product: Gridbox by Balbooa, a page builder and website toolkit for Joomla.
- Affected versions: Gridbox before 2.20.2.
- Fixed version: 2.20.2 per the Joomla CNA record. mySites.guru reports 2.20.4.0 as the current version to install, with two later fixes.
- What the record says: the registration method accepts user supplied group IDs, so unauthenticated actors can register accounts with administrative permissions.
- Weakness: CWE-284 improper access control. The registration code trusted a value the visitor supplied.
- Severity: CVSS 3.1 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No account is needed. - Exploitation: mySites.guru says the CVE record carries exploit maturity Attacked for this CVE and that the Joomla Security Strike Team reported active exploitation of Gridbox issues on 29 July 2026. The CISA KEV flag in our record is false.
How to check if you're exposed
In the Joomla administrator, open System, then Manage, then Extensions, search for Gridbox, and read the installed version. Any version below 2.20.2 is in range for this CVE. mySites.guru also says 2.20.4.0 fixed two further issues, so aim for the newest release and not only 2.20.2.
You can also read the version from the extension manifest on disk:
grep -r --include='*.xml' -i '<version>' /path/to/site/administrator/components/com_gridbox/ | head
Check every Joomla site you host, including staging copies that are reachable from the internet. If Gridbox has ever run on a site, review it for signs of compromise even after updating, because an update does not remove accounts or files an attacker already created.
What to do now
- Update Gridbox to the newest release, at least 2.20.2 and ideally 2.20.4.0 (the version mySites.guru names as the one to install).
- Take a backup first, as for any extension update on a production site.
- Review the Users list for administrator or Super User accounts you did not create.
- Delete any account you cannot account for, then reset passwords for real administrators.
- Look for PHP files in web reachable folders that you did not put there.
- If you cannot update today, disable or unpublish Gridbox and restrict public access to the site.
Why it matters
The cause is simple. A sign up form should assign a fixed default group. This one added the default group to whatever groups the visitor asked for, according to mySites.guru, instead of replacing them. Anyone could register a normal looking account and ask for administrator rights in the same request.
That makes this one of the most dangerous kinds of flaw. It needs no skill, no prior access and no chain of other bugs. mySites.guru describes batches of generated usernames with matching outlook.com addresses arriving minutes apart on a compromised site, and says some of the accounts failed to become Super Users and sat in the default group looking like ordinary sign ups. Those are still the attacker's, and they are still a way back in.
Weakness class matters here too. Improper access control is the plain failure to check what a requester is allowed to ask for. Server side code must decide permissions, never accept them from the client. If your own code takes roles, groups or price fields from a request body, this is the pattern to look for.
The same report ties this flaw to a second one: the record notes that an authenticated file upload flaw (CVE-2026-65885) becomes code execution when chained with this one, because the attacker can create the account that the upload flaw needs. Updating closes both routes, but only if you also remove any accounts created before the update.
Try it yourself
This walkthrough shows how findings from many sites can be tracked, ranked and closed in one place.
Click through it at your own pace, or open it full screen.
Quick check
How do I tell if I was hit?
Look for administrator or Super User accounts you did not create, and for a run of odd registrations, including ones that never became administrators. mySites.guru describes generated usernames and outlook.com addresses arriving in batches. Also look for unfamiliar PHP files in web reachable folders.
Is updating enough?
Not if the site was exposed. Updating stops new abuse. It does not delete accounts or files an attacker already created, so audit users and files as well.
Is this exploited in the wild?
mySites.guru says so and says the Joomla Security Strike Team confirmed it. The CISA KEV flag in our record is false, so cite the source if you quote this.
Sources
- mySites.guru: Gridbox, 23 more critical vulnerabilities
- Balbooa Gridbox product page
- Gold record for CVE-2026-65884
Last reviewed: 19 October 2026.
