CVE-2026-102789EUVD-2026-110644
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
The Gridbox extension for Joomla, developed by balbooa.com, is affected by this flaw. An attacker who can reach its editor functionality could retrieve blog post data without the authorization check that protects the other editor tasks.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check.
Affected versions
- com_gridbox
1.0.0-2.20.4.1