CVE-2026-65887 is a critical (CVSS 9.8) flaw in Gridbox for Joomla. Before 2.20.2, the resetPassword method let anyone reset the password of any user except Super Users, then sign in as that user. mySites.guru reports it as exploited. Update Gridbox and review accounts.
What's affected
- Product: Gridbox by Balbooa, a page builder and website toolkit for Joomla.
- Affected versions: Gridbox before 2.20.2.
- Fixed version: 2.20.2 per the Joomla CNA record. mySites.guru reports 2.20.4.0 as the current version to install, with two later fixes.
- What the record says: the resetPassword method allows actors to reset any user password, allowing them to log in and act as those users, excluding super admins.
- Weakness: CWE-284 improper access control. The method did not check that the caller owned the account being reset.
- Severity: CVSS 3.1 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No account is needed. - Exploitation: mySites.guru says the CVE record carries exploit maturity Attacked for this CVE and that the Joomla Security Strike Team reported active exploitation of Gridbox issues on 29 July 2026. The CISA KEV flag in our record is false.
How to check if you're exposed
In the Joomla administrator, open System, then Manage, then Extensions, search for Gridbox, and read the installed version. Any version below 2.20.2 is in range for this CVE. mySites.guru also says 2.20.4.0 fixed two further issues, so aim for the newest release and not only 2.20.2.
You can also read the version from the extension manifest on disk:
grep -r --include='*.xml' -i '<version>' /path/to/site/administrator/components/com_gridbox/ | head
Check every Joomla site you host, including staging copies that are reachable from the internet. If Gridbox has ever run on a site, review it for signs of compromise even after updating, because an update does not remove accounts or files an attacker already created.
What to do now
- Update Gridbox to the newest release, at least 2.20.2 and ideally 2.20.4.0 (the version mySites.guru names as the one to install).
- Take a backup first, as for any extension update on a production site.
- Review the Users list for administrator or Super User accounts you did not create.
- Look for PHP files in web reachable folders that you did not put there.
- If you cannot update today, disable or unpublish Gridbox and restrict public access to the site.
Why it matters
A password reset must prove that the requester controls the account, usually by sending a one time link to the owner's email. Here the method accepted the request without that proof, so any visitor could set a new password for another person's account.
Super Users are excluded, which sounds reassuring. It is less so in practice. Joomla sites commonly have editors, shop managers and other privileged roles below Super User, and those accounts can publish content, change settings or approve orders. An attacker who takes one of them can often reach a Super User through another route, such as the registration flaw tracked as CVE-2026-65884.
Treat the user table as suspect on any site that ran an affected version. Passwords of real users may have been changed by someone else, and you may see users locked out of their own accounts as the first sign.
Quick check
Are Super Users safe from this one?
The record excludes them from this particular flaw. Other accounts with elevated rights are not excluded, and other Gridbox flaws target administrator access, so do not rely on that exclusion.
What should I do about passwords?
After updating, reset passwords for privileged accounts through a channel you trust, and check whether any user reports being locked out unexpectedly.
Sources
- mySites.guru: Gridbox, 23 more critical vulnerabilities
- Balbooa Gridbox product page
- Gold record for CVE-2026-65887
Last reviewed: 19 October 2026.
