EXPOSURES › CVE-2026-65888

CVE-2026-65888

CRITICAL

DETAIL

SourceNVD · cve Published2026-07-29 CVSS9.8 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-65888 ↗

SHAME 78/100 unpatchedexploited-in-wilddata-breach

CVE-2026-65888 allows attackers to take over any user account on Joomla sites using the Gridbox extension via the socialLogin method.

The socialLogin method in Gridbox < 2.20.2 lets attackers log in as any user, enabling account takeover and data exfiltration. DIB orgs must patch this immediately as it bypasses authentication controls and violates NIST 800-171 access restrictions. The vendor has a critical posture with prior RCE flaws, increasing supply-chain risk.

Shame score — A critical account takeover flaw in a widely used Joomla extension, compounded by the vendor's history of unpatched RCE vulnerabilities, demonstrates severe negligence in maintaining secure software.

▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.

PLAYERS IMPLICATED

Balbooa · vendor gridbox · product

DESCRIPTION

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.

AFFECTED FEDRAMP PRODUCTS · 0

No correlated FedRAMP products.