CVE-2026-65888 is a critical (CVSS 9.8) account takeover flaw in Gridbox for Joomla. Before 2.20.2, the socialLogin method let actors log in as any given user on the site. mySites.guru reports it as exploited. Update Gridbox and audit accounts and recent logins.
What's affected
- Product: Gridbox by Balbooa, a page builder and website toolkit for Joomla.
- Affected versions: Gridbox before 2.20.2.
- Fixed version: 2.20.2 per the Joomla CNA record. mySites.guru reports 2.20.4.0 as the current version to install, with two later fixes.
- What the record says: the socialLogin method allows actors to log in as any given user on the target site.
- Weakness: CWE-284 improper access control. The login method did not tie the request to a verified identity.
- Severity: CVSS 3.1 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No account is needed. - Exploitation: mySites.guru says the CVE record carries exploit maturity Attacked for this CVE and that the Joomla Security Strike Team reported active exploitation of Gridbox issues on 29 July 2026. The CISA KEV flag in our record is false.
How to check if you're exposed
In the Joomla administrator, open System, then Manage, then Extensions, search for Gridbox, and read the installed version. Any version below 2.20.2 is in range for this CVE. mySites.guru also says 2.20.4.0 fixed two further issues, so aim for the newest release and not only 2.20.2.
You can also read the version from the extension manifest on disk:
grep -r --include='*.xml' -i '<version>' /path/to/site/administrator/components/com_gridbox/ | head
Check every Joomla site you host, including staging copies that are reachable from the internet. If Gridbox has ever run on a site, review it for signs of compromise even after updating, because an update does not remove accounts or files an attacker already created.
What to do now
- Update Gridbox to the newest release, at least 2.20.2 and ideally 2.20.4.0 (the version mySites.guru names as the one to install).
- Take a backup first, as for any extension update on a production site.
- Review the Users list for administrator or Super User accounts you did not create.
- Look for PHP files in web reachable folders that you did not put there.
- If you cannot update today, disable or unpublish Gridbox and restrict public access to the site.
Why it matters
Social login is meant to accept an identity that another provider has verified. If the server accepts the claim without verifying it, the login becomes a way in for anyone who knows or guesses a username or email.
The record describes the result in one line: the caller can log in as any user on the site. No password is needed and no reset email is sent, so the account owner gets no warning. That makes review of account activity more useful than waiting for complaints.
If Gridbox is on your site, look at recent logins for privileged accounts, and compare them with when those people actually worked. The Joomla user log and the web server access log are the two places to start.
Quick check
Does this leave a trace?
It can. Check the Joomla action logs and web server access logs for logins you cannot match to a real person, and for changes made right after them.
Does the site need social login turned on?
The record does not say that setting protects you. Do not rely on turning a feature off. Update the extension.
Sources
- mySites.guru: Gridbox, 23 more critical vulnerabilities
- Balbooa Gridbox product page
- Gold record for CVE-2026-65888
Last reviewed: 19 October 2026.
