CVE-2026-65890: Joomla Gridbox Extension SQLi Vulnerability

CVE-2026-65890 Overview

CVE-2026-65890 is an unauthenticated SQL injection vulnerability in Balbooa Gridbox, a Joomla extension for building websites. The flaw affects Gridbox versions prior to 2.20.2 and exposes multiple SQL injection vectors that accept unsanitized input. Unauthenticated attackers can inject arbitrary SQL statements into backend queries over the network. The vulnerability is tracked under CWE-89: SQL Injection and carries a CVSS 4.0 base score of 9.2.

Critical Impact
Unauthenticated attackers can inject SQL through multiple Gridbox parameters, exposing database contents and enabling downstream compromise of Joomla sites.

Affected Products

Balbooa Gridbox for Joomla, versions prior to 2.20.2
Joomla sites with the Gridbox extension installed and enabled
Any hosting environment exposing vulnerable Gridbox endpoints to the internet

Discovery Timeline

2026-07-29 - CVE-2026-65890 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-65890

Vulnerability Analysis

The vulnerability resides in Balbooa Gridbox, a page-builder extension for Joomla. Multiple request parameters flow into SQL queries without proper sanitization or parameterization. Attackers reach the vulnerable code paths without authentication, so no valid Joomla account is required. Because the injection points are inside data-fetching queries, attackers can retrieve arbitrary rows from the Joomla database, including user records and session data.

The scope extends beyond confidentiality. The CVSS 4.0 vector records subsequent-system impact on confidentiality, integrity, and availability, meaning a successful attack can affect components beyond the Gridbox extension itself. Compromise of the Joomla #__users table typically leads to administrative account takeover and full site compromise.

Root Cause

The root cause is missing input validation and unsafe query construction inside Gridbox request handlers. User-controlled parameters are concatenated into SQL statements instead of being bound as parameters. This is a textbook CWE-89 pattern. Multiple vectors share the same defect, which indicates a systemic lack of prepared statements across Gridbox query code paths.

Attack Vector

Exploitation occurs over HTTP against a Joomla site running vulnerable Gridbox. Attackers craft requests to Gridbox endpoints and inject SQL metacharacters into susceptible parameters. Because no authentication is required, attacks can be automated at scale using scanners that fingerprint Gridbox and probe known parameters. See the MySites Guru advisory for a technical write-up and the Balbooa Gridbox product page for vendor information.

No verified proof-of-concept code is published in the referenced advisory. Refer to the third-party advisory for parameter-level detail.

Detection Methods for CVE-2026-65890

Indicators of Compromise

HTTP requests to Gridbox endpoints containing SQL metacharacters such as ', UNION SELECT, SLEEP(, or -- in query or POST parameters.
Unexpected outbound queries or error responses from the Joomla site referencing MySQL syntax errors.
New or modified administrator accounts in the Joomla #__users table without a corresponding admin action.
Web server access logs showing repeated probing of Gridbox routes from a single source IP.

Detection Strategies

Deploy web application firewall (WAF) signatures for SQL injection patterns targeting Gridbox request parameters.
Enable MySQL general query logging on non-production instances to identify anomalous UNION, time-based, or boolean-based payloads.
Correlate 500-level HTTP responses from Joomla with database error strings to surface injection attempts.
Baseline the Gridbox extension's normal parameter values and alert on payloads containing SQL keywords.

Monitoring Recommendations

Forward Joomla, Apache/Nginx, and MySQL logs to a centralized SIEM for correlation and retention.
Monitor privileged account creation and permission changes in Joomla administrative tables.
Track file integrity for the Joomla administrator/ and Gridbox extension directories to detect webshell drops following successful injection.

How to Mitigate CVE-2026-65890

Immediate Actions Required

Upgrade Balbooa Gridbox to version 2.20.2 or later on every Joomla site where it is installed.
Audit the Joomla #__users table and administrator group membership for unauthorized accounts.
Rotate credentials for any Joomla administrator accounts and force password resets for site users.
Review web server and database logs since installation of the vulnerable Gridbox versions for signs of exploitation.

Patch Information

Balbooa addresses the SQL injection vectors in Gridbox 2.20.2. Upgrade through the Joomla extension manager or by downloading the latest release from the Balbooa Gridbox product page. Full remediation details are available in the MySites Guru advisory.

Workarounds

If immediate patching is not possible, disable the Gridbox extension in the Joomla administrator until the update can be applied.
Place the Joomla site behind a WAF with SQL injection rulesets and restrict access to Gridbox endpoints by IP where feasible.
Enforce least-privilege on the MySQL user configured in configuration.php so that the database account cannot read other schemas or write files.

bash

# Configuration example: restrict MySQL privileges for the Joomla DB user
mysql -u root -p <<'SQL'
REVOKE ALL PRIVILEGES ON *.* FROM 'joomla_user'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON joomla_db.* TO 'joomla_user'@'localhost';
FLUSH PRIVILEGES;
SQL