{"id":"CVE-2026-102789","kind":"vulnerability","aliases":["CVE-2026-102789"],"related":[],"title":"Joomla Gridbox extension: missing authorization check exposes blog post data","description":"Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check.","summary":"The Gridbox extension for Joomla, before 2.20.4.2, has an editor controller task (getBlogPosts) that skips the edit-level permission check the other tasks perform. An attacker can call that task to read blog post data they should not be able to see.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","gridbox","joomla","package","php"],"not_affected_if":["gridbox-not-installed","version-2.20.4.2-or-later"],"how_to_check":"- Check the installed Gridbox version in the Joomla administrator under Extensions > Manage; versions below `2.20.4.2` are affected.\n- Confirm whether the Gridbox component is installed at all: `unknown` beyond the version check.","fix":"- Update the Gridbox extension to `2.20.4.2` or later from the vendor (balbooa.com).\n- Until updated, disable the Gridbox extension if it is not needed.","status":"open","published_at":"2026-10-27T10:16:53+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","triaged_at":"2026-10-27T10:31:51+00:00","updated_at":"2026-10-27T10:31:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T10:31:51Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Gridbox extension to `2.20.4.2` or later from the vendor (balbooa.com).\n- Until updated, disable the Gridbox extension if it is not needed.","reach":"internet","title":"Joomla Gridbox extension: missing authorization check exposes blog post data","impact":"medium","summary":"The Gridbox extension for Joomla, before 2.20.4.2, has an editor controller task (getBlogPosts) that skips the edit-level permission check the other tasks perform. An attacker can call that task to read blog post data they should not be able to see.","category":"package","nicknames":[],"who_cares":["joomla","gridbox","cms","php"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unauthorized users read blog post data through the editor task","analyst_note":"Confirm from the NVD entry or vendor advisory whether the task requires any login, and what data getBlogPosts returns; the description does not say the flaw is critical in impact despite the 9.3 CVSS score.","how_to_check":"- Check the installed Gridbox version in the Joomla administrator under Extensions > Manage; versions below `2.20.4.2` are affected.\n- Confirm whether the Gridbox component is installed at all: `unknown` beyond the version check.","needs_analyst":true,"not_affected_if":["gridbox-not-installed","version-2.20.4.2-or-later"],"who_is_affected":"Joomla sites running the Gridbox page builder extension below `2.20.4.2`. The flaw sits in the editor controller, so any site with Gridbox installed is in scope; sites without Gridbox are not affected. Whether an anonymous visitor can reach the task is unknown from the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000649,"input_tokens":3351,"output_tokens":627,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-102789':13A,16A '-2026':12A,15A '2.20.4.2':28B,77C 'abl':62B 'attack':48B 'author':5A,69C 'balbooa.com':67C 'blog':8A,55B 'call':50B 'check':6A,42B,70C,98C 'checkusereditlevel':97C 'cms':17B 'control':32B,73C,92C 'cve':11A,14A 'data':10A,57B 'edit':39B 'edit-level':38B 'editor':31B,72C 'editorcontrol':78C 'expos':7A 'extens':3A,24B,66C 'getblogpost':34B,79C,86C 'gridbox':2A,18B,23B,76C 'gridboxhelp':96C 'invok':85C 'joomla':1A,19B,26B,65C 'level':40B 'miss':4A,68C 'omit':94C 'order':82C 'packag':20B 'paramet':83C 'perform':46B 'permiss':41B 'php':21B 'post':9A,56B 'read':54B,80C 'see':64B 'skip':36B 'task':33B,45B,52B,74C,89C 'unlik':87C","nicknames":[],"mitigations":[],"who_affected":"Joomla sites running the Gridbox page builder extension below `2.20.4.2`. The flaw sits in the editor controller, so any site with Gridbox installed is in scope; sites without Gridbox are not affected. Whether an anonymous visitor can reach the task is unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T10:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102789","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102789","severity":null,"published_at":"2026-10-27T10:16:53+00:00","modified_at":"2026-10-27T10:16:53+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","fetched_at":"2026-10-27T10:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}