Vulnerability · Published Oct 8, 2026 · Assigned by Joomla

CVE-2026-102784Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0

High 8.7

In plain English

A high-severity cross-site request forgery in Gridbox extension for Joomla from balbooa.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.2%top 93.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request input. A GET request can therefore reach the action without the trait checking a token. The action still requires core.tools , but that is the victim’s permission check; it does not prove that the privileged user intended the request.

Affected products (as reported)

Vendor	Product	Versions
balbooa.com	Gridbox extension for Joomla	1.0.0-2.20.3.1

Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.balbooa.com/gridbox product