CVE-2026-65947

CVE-2026-65947 patches multiple CSRF vulnerabilities in balbooa Gridbox, a commercial Joomla page builder extension. The CVSS 7.3 score is misleading—admin panel CSRF in a widely-deployed commercial product creates blast radius that simple severity metrics don't capture. An attacker with a compromised admin session can chain actions across these six independent vectors: modify configuration, inject template code, create rogue admin accounts, and potentially pivot to hosting-level access. If you're running Gridbox, update to 2.20.2 immediately—this is not a 'nice to have' patch. The vulnerability exists because the development team treated the admin interface as a trusted internal zone where CSRF tokens were optional. This is a documented pattern in CMS extension development: once you're behind the login wall, developers incorrectly assume authentication alone is sufficient protection. What to verify: confirm your Gridbox installation is at 2.20.2 or later. If you're on a paid version, understand that security patches may only be available in current subscription tiers—older paid versions may remain vulnerable. Review admin session hygiene on your Joomla instance: SameSite cookie attributes on admin sessions provide defense-in-depth if CSRF tokens are missed in future development. The vulnerability exists in the workflow architecture, not just the code—future feature additions will face the same regression risk without framework-level enforcement.

Reviewed through automated stages and approved by a human before publication.