CVE-2026-102789: Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2
Published Oct 27, 2026
·Updated
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check.
Affected Software
1 affected component
balbooa.com Gridbox<2.20.4.2
Event History
Oct 27, 2026
CVE Published
via MITRE·09:23 AM
Data Sourced
via MITRE·09:23 AM
DescriptionWeakness
Frequently Asked Questions
1
Which Gridbox versions are affected?
Gridbox versions earlier than 2.20.4.2 are affected.
2
What authorization control is missing?
The EditorController::getBlogPosts() task does not call GridboxHelper::checkUserEditLevel(), unlike other tasks in that controller.
3
What operation is exposed by the missing check?
The affected task reads the order parameter and invokes getBlogPosts() without performing the Gridbox edit-level authorization check.