CVE-2026-102784 — Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0

Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request input. A GET request can therefore reach the action without the trait checking a token. The action still requires core.tools , but that is the victim’s permission check; it does not prove that the privileged user intended the request.

Published Oct 8, 2026Updated Oct 8, 2026Sources: cvelistV5, Joomla

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Unreported

no source claims exploitation

EPSS

Not scored

FIRST has not published a score

Affects

balbooa com

gridbox_extension_for_joomla

CVSS base

8.7

HIGH

CISA SSVC assessment

Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.

CISA

Exploitation

None

none · proof-of-concept · active

Automatable

can an attacker script all four kill-chain steps

Technical impact

Total

partial · total control of the vulnerable component

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Vendors (1)

balbooa com

Products (1)

gridbox extension for joomla

Every base score collected

Sources score independently and disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Source
8.7	CVSS 4.0	HIGH	—	—	cvelistV5

Weakness & attack patterns

CWE-352

References

1 on the record

www.balbooa.com/gridbox
product

Elsewhere on this site

balbooa comevery CVE for this vendor
CWE-352other pages naming this weakness

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.