Live › vulnerability › CVE-2026-102789
Go to dashboardThe Gridbox extension for Joomla, before 2.20.4.2, has an editor controller task (getBlogPosts) that skips the edit-level permission check the other tasks perform. An attacker can call that task to read blog post data they should not be able to see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 10:31 UTC. All times on this page are UTC.
Joomla sites running the Gridbox page builder extension below . The flaw sits in the editor controller, so any site with Gridbox installed is in scope; sites without Gridbox are not affected. Whether an anonymous visitor can reach the task is unknown from the sources.
2.20.4.2No product ranges from the sources yet.
2.20.4.2 are affected.unknown beyond the version check.2.20.4.2 or later from the vendor (balbooa.com).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check.
This page as .md · .json · in your agent: get_signal("CVE-2026-102789")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.