Unauthenticated Arbitrary Password Reset in Balbooa Gridbox

An unauthenticated attacker can take over arbitrary non-super-administrator Gridbox/Joomla user accounts. This provides unauthorized access to data and administrative or content-management functions available to each compromised account, enabling actions under the victim account's authority. The vulnerability has been reported as actively exploited in the wild.

If immediate patching is not possible, reduce exposure to unauthenticated access to the vulnerable Gridbox functionality by restricting public access to the affected Joomla instance or placing administrative and sensitive application components behind additional access controls. Monitor for unexpected password reset activity and anomalous logins involving non-super-admin accounts, and proactively rotate credentials for accounts that may have been exposed. These measures are temporary and do not eliminate the underlying flaw; upgrading to a fixed version is required.

Upgrade the Balbooa Gridbox extension to version 2.20.2 or later.