CVE-2026-102784: Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0

Q: Which users are relevant to exploitation?

The request is only processed when the victim has the Joomla core.tools permission. An attacker does not need privileges, but must cause a user with that permission to make the request.

Q: What request conditions allow the token check to be bypassed?

The affected action can be reached with a GET request. Because session-token validation in the shared trait is performed only for POST requests, the GET path does not receive that validation.

Q: How can I determine whether my site is affected?

Check the installed Balbooa Gridbox version. Versions earlier than 2.20.4.0 are affected.

Published Oct 8, 2026

Updated

Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request input. A GET request can therefore reach the action without the trait checking a token. The action still requires core.tools , but that is the victim’s permission check; it does not prove that the privileged user intended the request.

Affected Software

1 affected component

Balbooa Gridbox<2.20.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Joomla Extension - balbooa.com - Gridbox to a version that resolves this vulnerability.
Fixed in 2.20.4.0

Event History

Oct 8, 2026

CVE Published

via MITRE·12:32 PM

Data Sourced

via MITRE·12:32 PM

DescriptionWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users are relevant to exploitation?

The request is only processed when the victim has the Joomla core.tools permission. An attacker does not need privileges, but must cause a user with that permission to make the request.

What request conditions allow the token check to be bypassed?

The affected action can be reached with a GET request. Because session-token validation in the shared trait is performed only for POST requests, the GET path does not receive that validation.

How can I determine whether my site is affected?

Check the installed Balbooa Gridbox version. Versions earlier than 2.20.4.0 are affected.

CVE-2026-102784: Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users are relevant to exploitation?

What request conditions allow the token check to be bypassed?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Which users are relevant to exploitation?

What request conditions allow the token check to be bypassed?

How can I determine whether my site is affected?