Zero Radar
← feed
CriticalVulnerabilityCVE-2026-102789updated 27 Oct 2026, 10:17 UTC

Gridbox Joomla extension: missing permission check on blog post lookup

A website builder add-on for Joomla lets some people read data they should not see or use. The add-on skips a check that the other parts of it perform.

Fixed in Version 2.20.4.2 or laterOfficial source
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesVersion 2.20.4.2 or later · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

What happened

In the Gridbox extension for Joomla, the EditorController::getBlogPosts() task reads the order parameter and runs getBlogPosts() without calling GridboxHelper::checkUserEditLevel(), which other tasks in the controller perform. This is a missing authorization check.

Why it is dangerous: Users who should not have editing rights may be able to reach blog post data through this task, exposing content and potentially more on sites running the extension.

Are you affected?

You are affected if you run the Gridbox extension for Joomla at a version earlier than 2.20.4.2.

Gridbox Joomla extension (balbooa.com), versions before 2.20.4.2

What to do

  1. Update the Gridbox extension to version 2.20.4.2 or later
  2. Review Joomla user accounts and remove any that do not need access
  3. Check blog post data for unexpected changes or access if you cannot update right away

Timeline

  1. 27 Oct 2026, 10:16 UTC
    Publicly disclosed
  2. 27 Oct 2026, 10:16 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 10:17 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-102789
CVSS
9.3 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 10:16 UTC
On Zero Radar
27 Oct 2026, 10:17 UTC (1 min after disclosure)
Last change
27 Oct 2026, 10:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Gridbox Joomla extension: missing permission check on blog post lookup · Zero Radar