Balbooa Gridbox (Joomla): Cross-site request forgery in language installation
Summary
Gridbox, a page builder extension for Joomla from Balbooa, does not reliably check the Joomla session token in its language installation function. An attacker can trick a logged-in privileged user into visiting a malicious page that sends a request to install a language package from an attacker-chosen URL or ZIP file. The attack requires that the victim has the core.tools permission and is logged in to the Joomla back end.
Affected
- Gridbox extension for Joomla, versions 1.0.0 through 2.20.3.1
Fixed in
- Gridbox 2.20.4.0 (fix version per CNA record)
- Latest Gridbox build recommended; Balbooa published 2.20.4.2 on 27 Oct 2026
Workaround
- Unknown. No vendor workaround found.
- Interim measure (own recommendation, not from sources): limit the core.tools permission to the fewest administrator accounts.
- Interim measure (own recommendation, not from sources): log out of the Joomla back end when browsing other websites.
Exploitation
- No known exploitation in the wild; not marked as known exploited.
- No public proof of concept found; VulDB reports technical details known but no exploit available.
- The Joomla Security Strike Team reported that other Gridbox issues from earlier in 2026 were actively exploited.
Our recommendation
- Check the installed Gridbox version in the Joomla extension manager and update to the latest Balbooa build.
- Limit the core.tools permission to as few administrator accounts as possible.
- Ask administrators to log out of the Joomla back end before browsing other websites.
- Monitor Joomla logs for unexpected language package installations.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Balbooa: Gridbox 2.20.4.0 release blog www.balbooa.com
- Balbooa Gridbox product page (CVE record reference) www.balbooa.com
- VulDB 415347 vuldb.com
- HOL Guard: CVE-2026-102784 hol.org
- OffSeq Radar: CVE-2026-102784 radar.offseq.com
- Strix: CVE-2026-102784 www.strix.ai
- Vulners: RAPID7:CVE-2026-102784 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:18.
Original description (NVD)
Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request input. A GET request can therefore reach the action without the trait checking a token. The action still requires core.tools , but that is the victim’s permission check; it does not prove that the privileged user intended the request.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.