Balbooa Gridbox – several critical flaws, updating alone is not enough
安全なバージョン： Balbooa Gridbox 2.20.2 or newer · via Balbooa (account required)
ひと目でわかる基本情報
com_gridbox)どのような脆弱性ですか？
Balbooa Gridbox is a page builder for Joomla from the same vendor as Balbooa Forms. Versions up to and including 2.20.1 became known for several severe security flaws – seven of them carry their own CVE identifier.
Three reach the maximum score of 10 out of 10: a privilege escalation that allowed an administrator account to be created without a login (CVE-2026-65884), resetting anyone else’s password (CVE-2026-65887) and taking over existing accounts (CVE-2026-65888). On top of that come file access without a login, an SQL injection and a bypassable permission check.
This is the decisive point: with these flaws an update is not necessarily enough. If your site ran on a version up to 2.20.1 for any length of time, a planted administrator account may already exist. The update closes the way in – an account that is already there stays until it is removed.
自分のサイトは影響を受けますか？ – 確認方法
- Open the back end
Sign in to the Joomla administrator.
- Check the version
Open Extensions›Manage›Manage and filter for "Gridbox". If the version is 2.20.1 or lower, the site is vulnerable.
- Review the user list
Open Users›Manage and look for accounts you did not create yourself – especially ones with an odd user name and a throwaway address. Do not delete blindly; check first.
- Go through the extensions
In Extensions›Manage also review the plugin list for entries you never installed.
脆弱性を塞ぐ手順
- Before updating: back up
Back up files and database before you update.
- Open the update centre
Go to System›Update›Extensions and click Check for updates.
- Update Gridbox
Select the entry and update to 2.20.2 or newer. 2.20.1 is not enough.
- Afterwards: check accounts
Only after the update, go through the user list – an account created earlier does not disappear on its own.
公式の入手先： via Balbooa (account required). 必要な最低バージョン： Balbooa Gridbox 2.20.2 or newer.
すでに攻撃を受けている場合は？
サイトの復旧でお困りですか。対応できる専門家はJoomlaサービスプロバイダーディレクトリで探せます。
出典 & 参考リンク
- CVE-2026-65884 – privilege escalationSeverity 10 out of 10
- CVE-2026-65887 – resetting other passwordsSeverity 10 out of 10
- CVE-2026-65888 – account takeoverSeverity 10 out of 10
- Balbooa (vendor)Source of the safe version 2.20.2
最終的には、各開発元の公式発表が優先されます。本ページは、公開されている情報を中立的な立場で整理したものです。
Supporters of this site
htprotect.org is a free, vendor-independent information service. It is supported by:
Joomla host from Germany with active community support – discovered the first attack on the JCE vulnerability.
fc-hosting.de
Specialised in cleaning, maintaining and securing Joomla and WordPress websites.
website-bereinigung.deSupport this project
You run a hosting or Joomla service and would like to support htprotect.org – and be listed here as a supporter? Every contribution helps to warn and protect those affected faster.
Prefer to give privately, without a listing? A little something for the tip jar is just as welcome.
Manufactures and installs construction-site signs, hoardings and façade solutions – including design and 3D visualisation.
bauschildundservice.deProfessional IT support from Czechia – Windows management, domain administration and web hosting.
defendersoft.cz
Travel portal from Germany – package holidays, hotels and flights online, with personal travel-agency advice.
onlineweg.de
Creative agency from Brandenburg – web design, print media, photography and 360° panoramas from a single source.
criadero.deIT service provider from Wächtersbach – Joomla websites, PC service, hardware and software.
jahnedv.de
Information-security consulting from Berlin – security analyses, risk management and ISO 27001 for SMEs.
isari-consult.de