External risk intelligence

Joomla Gridbox Unauthenticated SQL Injection.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-65890

The vulnerability affects a Joomla extension, which is a component of a web application. Web applications and their associated extensions are designed to be public-facing by default to serve content to internet users, making this attack surface highly likely to be reachable from the internet.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves an unauthenticated SQL injection vulnerability in a Joomla extension, allowing unauthorized actors to insert malicious SQL code into database queries. The primary concern is confirming if this specific extension is in use and exposed to the internet.

Unauthenticated injection in a website extension.
SQL injection can compromise sensitive data.
Confirm extension use and exposure to the internet.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted SQL queries to a Joomla website using an affected Gridbox extension. Since no authentication is required, an attacker could trigger the vulnerability through multiple vectors, potentially leading to unauthorized access to sensitive data or manipulation of the website's database.

Unauthenticated access to the website.
Injecting malicious SQL queries.
Database compromise and data manipulation.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated actors could inject SQL queries into the Gridbox extension when it is used in supported conditions. This could potentially lead to unauthorized access or manipulation of the underlying database.

Database integrity and confidentiality.
Via unauthenticated SQL injection vectors.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The responsible teams for addressing this SQL injection vulnerability in a Joomla extension will likely include the application owner, who is accountable for the Joomla site's overall functionality and content, and the infrastructure or platform team managing the web server environment. The first practical step is to identify all instances of the affected Gridbox extension, assess their exposure and business criticality, and then coordinate with the vendor for a fix or plan mitigation strategies based on the identified risk.

Application and platform teams own the issue.
Verify extension reachability and business criticality.
Plan vendor coordination and risk mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Joomla Gridbox extension?

Joomla Gridbox is a page builder extension designed for the Joomla content management system. It provides a visual interface for users to create and manage website layouts, pages, and themes directly within their site. Because it integrates deeply into the website architecture, it processes user requests and interacts with the underlying database to render content, making it a functional component for web design and site administration.

What does SQL injection mean for CVE-2026-65890?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In the context of CVE-2026-65890, it means the Gridbox extension does not properly filter or validate user-provided input before using it in database queries. This flaw allows an external party to inject their own malicious SQL commands into the application, potentially tricking the database into revealing, modifying, or deleting sensitive information.

How can an attacker trigger this vulnerability?

An attacker can exploit this by sending specially crafted web requests that contain malicious SQL payloads directly to an affected Joomla site. Because this is an unauthenticated vulnerability, the attacker does not need a login or account to perform these actions. Note that simply viewing a standard page without interacting with the specific vulnerable extension features will not trigger the bug; the attacker must target the specific inputs processed by the affected Gridbox components.

Is my website at risk from this vulnerability?

According to Halo Surface Signal, this vulnerability affects a web application component, which is typically designed to be public-facing to serve content. Because Joomla extensions are often reachable from the internet, they are highly likely to be exposed. You should prioritize assessing any internet-facing Joomla site running an affected version of the Gridbox extension, as these assets are the most accessible to external actors attempting to exploit the flaw.

What are the first steps to secure my site?

Begin by auditing your environment to identify all instances where the Gridbox extension is currently installed and active. Check your version numbers against the affected range to confirm if you are running software prior to version 2.20.2. Once identified, evaluate the criticality of the site and coordinate with the vendor or your technical team to apply the necessary updates or mitigation strategies provided by Balbooa to address the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.