CVE-2026-65890 is a critical (CVSS 9.8) unauthenticated SQL injection in Gridbox for Joomla, with multiple injection points. It is fixed in Gridbox 2.20.2, and mySites.guru names 2.20.4.0 as the current version to install. Update, then check your database for tampering and exposed password hashes.
What's affected
- Product: Gridbox by Balbooa, a page builder and website toolkit for Joomla.
- Affected versions: Gridbox before 2.20.2.
- Fixed version: 2.20.2 per the Joomla CNA record. mySites.guru reports 2.20.4.0 as the current version to install, with two later fixes.
- What the record says: multiple SQL injection vectors allow unauthenticated actors to inject SQL in queries.
- Weakness: CWE-89 SQL injection. The component builds queries from request input without safe parameter handling.
- Severity: CVSS 3.1 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No account is needed. - Exploitation: mySites.guru reports that several Gridbox flaws are being exploited. It does not mark this CVE as Attacked in its CVE table, and the CISA KEV flag in our record is false. Treat the whole component as at risk.
How to check if you're exposed
In the Joomla administrator, open System, then Manage, then Extensions, search for Gridbox, and read the installed version. Any version below 2.20.2 is in range for this CVE. mySites.guru also says 2.20.4.0 fixed two further issues, so aim for the newest release and not only 2.20.2.
You can also read the version from the extension manifest on disk:
grep -r --include='*.xml' -i '<version>' /path/to/site/administrator/components/com_gridbox/ | head
Check every Joomla site you host, including staging copies that are reachable from the internet. If Gridbox has ever run on a site, review it for signs of compromise even after updating, because an update does not remove accounts or files an attacker already created.
What to do now
- Update Gridbox to the newest release, at least 2.20.2 and ideally 2.20.4.0 (the version mySites.guru names as the one to install).
- Take a backup first, as for any extension update on a production site.
- Review the Users list for administrator or Super User accounts you did not create.
- Look for PHP files in web reachable folders that you did not put there.
- If you cannot update today, disable or unpublish Gridbox and restrict public access to the site.
Why it matters
SQL injection happens when input is placed into a database query as code, not as data. The fix is parameterised queries, where the database receives the query and the values separately.
The record lists several vectors, all reachable without logging in. mySites.guru says the Gridbox flaws as a group can expose every user's password hash. A database leak has a long tail: hashes can be cracked offline, and email addresses and other stored data may be reused against other services.
After updating, plan for that tail. Force password resets for privileged users, check for new or changed accounts, and consider whether any site data would need a breach notice under your own obligations. The update stops further abuse, and it does not tell you what was read earlier.
Quick check
What can an attacker read through SQL injection?
Anything the database account can read. On a Joomla site that includes the user table and its password hashes. mySites.guru says the Gridbox issues can expose every user's hash.
Is this one marked as exploited?
mySites.guru marks other Gridbox CVEs as Attacked but does not mark this one in its table. It still warns that the component as a whole is under attack, so patch now.
Sources
- mySites.guru: Gridbox, 23 more critical vulnerabilities
- Balbooa Gridbox product page
- Gold record for CVE-2026-65890
Last reviewed: 19 October 2026.
