中文

// CVE · PUBLISHED 2026-10-27

CVE-2026-102789

balbooa.com / Gridbox extension for Joomla

9.3 · CVSS 4.0Critical

Description

Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check.

References

Related CVEs

  • CVE-2026-76934Hitachi / JP1/Automatic Job Management System 3 - Manager · +2CVSS 9.8
  • CVE-2026-76933Hitachi / JP1/Automatic Job Management System 3 - Manager · +2CVSS 9.4
  • CVE-2026-76932Hitachi / JP1/Automatic Job Management System 3 - Manager · +2CVSS 9.4
  • CVE-2026-102788balbooa.com / Gridbox extension for JoomlaCVSS 9.3
  • CVE-2026-92885Qode Themes / Qode MembershipCVSS 9.8
  • CVE-2026-102425balbooa.com / Balbooa Forms extension for JoomlaCVSS 9.5
  • CVE-2026-65888balbooa.com / Gridbox extension for JoomlaCVSS 10.0
  • CVE-2026-65887balbooa.com / Gridbox extension for JoomlaCVSS 10.0

← CVE Index: search every CVE from the last 30 days

This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.