CVE-2026-102784: Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0
Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request input. A GET request can therefore reach the action without the trait checking a token. The action still requires core.tools , but that is the victim’s permission check; it does not prove that the privileged user intended the request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joomla Extension - balbooa.com - Gridboxto a version that resolves this vulnerability.Fixed in 2.20.4.0
Event History
Frequently Asked Questions
Which users are relevant to exploitation?
The request is only processed when the victim has the Joomla core.tools permission. An attacker does not need privileges, but must cause a user with that permission to make the request.
What request conditions allow the token check to be bypassed?
The affected action can be reached with a GET request. Because session-token validation in the shared trait is performed only for POST requests, the GET path does not receive that validation.
How can I determine whether my site is affected?
Check the installed Balbooa Gridbox version. Versions earlier than 2.20.4.0 are affected.