# CVE-2026-61425: Balbooa Gridbox for Joomla authentication bypass in Super User login

Source: https://junglewise.ai/threats/cve-2026-61425-balbooa-gridbox-for-joomla-authentication-bypass-in-super-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-61425 · Severity: info · CVSS 9.4 · Published 2026-07-20

Gridbox, a popular drag-and-drop page builder for the Joomla content management system, contains a critical security flaw that allows unauthorized individuals to gain full administrative control. By simply setting a specific browser cookie, an attacker can bypass the login process and access the site as a 'Super User' without needing a password. This level of access allows an attacker to modify the website, steal data, or potentially take over the entire web server.

Technologies: [Balbooa Gridbox](https://junglewise.ai/threats/technologies/gridbox). Vendors: [Balbooa](https://junglewise.ai/threats/vendors/balbooa).

## Quick answers

**Is CVE-2026-61425 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61425 being exploited in the wild.

**How severe is CVE-2026-61425?** Informational severity, with a CVSS score of 9.4, published 20 July 2026.

**Which products and versions are affected?** Balbooa Gridbox 1.0.0-2.20.0.2.

**Is there a fix for CVE-2026-61425?** A patch was published on 2026-07-20: Fixed version 2.20.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61425 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61425?** Check whether you run Balbooa Gridbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A critical authentication bypass exists in the Balbooa Gridbox extension for Joomla due to improper validation of user-supplied identity markers. The extension trusts a value provided in a browser cookie as proof of identity without verifying it against a valid session or password. An unauthenticated attacker can exploit this by setting a cookie to a known administrator's username, granting them immediate Super User privileges. Because Joomla Super Users can edit PHP template files through the administrative interface, this vulnerability effectively provides a path to Remote Code Execution (RCE). The issue is fixed in version 2.20.1.

## Affected products

- Balbooa Gridbox extension for Joomla 1.0.0-2.20.0.2

## Timeline

- 2025-10-21: other: Vulnerable version 2.20.0.2 released
- 2026-07-17: other: Vulnerability discovered and reported to vendor by mySites.guru
- 2026-07-20: patched: Fixed version 2.20.1 released
- 2026-07-20: disclosed: Public disclosure by mySites.guru and CVE assignment

## References

- [https://mysites.guru/blog/gridbox-critical-authentication-bypass/](https://mysites.guru/blog/gridbox-critical-authentication-bypass/)
- [https://www.balbooa.com/gridbox](https://www.balbooa.com/gridbox)

## Related threats

- [Balbooa Gridbox stored XSS in reviews](https://junglewise.ai/threats/cve-2026-107903-joomla-extension-balbooa-com-stored-xss-in-reviews-via)
- [balbooa Gridbox unauthenticated arbitrary file deletion via path traversal](https://junglewise.ai/threats/cve-2026-107129-joomla-extension-balbooa-com-unauthenticated-arbitrary-file)
- [Joomla Gridbox extension SQL injection in product sorting](https://junglewise.ai/threats/cve-2026-102788-joomla-extension-balbooa-com-unauthenticated-sql-injection-in)
- [Balbooa Gridbox CSRF in administrative interface](https://junglewise.ai/threats/cve-2026-65947-balbooa-gridbox-csrf-in-administrative-interface)
- [Balbooa Gridbox account takeover via socialLogin method](https://junglewise.ai/threats/cve-2026-65888-balbooa-gridbox-account-takeover-via-sociallogin-method)