CVE-2026-65887

Unauthenticated password reset in Gridbox Joomla extension allows attackers to compromise user accounts.

The Gridbox Joomla extension (v<2.20.2) contains an unauthenticated password reset vulnerability that lets attackers reset any user's password except super admins, enabling account takeover. DIB organizations must patch this immediately and audit Joomla extensions for similar flaws, as Balbooa already has a critical security posture with recent RCE vulnerabilities.

Shame score — A critical unauthenticated privilege escalation flaw in a widely-used extension, compounded by the vendor's known critical security posture and recent RCE vulnerabilities.