Security
Gridbox 2.20.4.2 fixes two critical SQL flaws
Balbooa has released Gridbox 2.20.4.2 to address two critical vulnerabilities that could be exploited without a Joomla login.
The affected Joomla page builder is Gridbox, with releases from 1.0.0 through 2.20.4.1 listed as vulnerable. The fixed release is 2.20.4.2.
Research published by mySites.guru says the issues involve SQL injection in public listing functionality. CVE-2026-102788 concerns an injectable store and category list sort-order value. CVE-2026-102789 covers a missing authorisation check on a page-editor task that could expose the same query path. The Joomla CNA rates both issues Critical at CVSS 4.0 9.3; the records classify them as CWE-89 SQL injection and CWE-284 missing authorisation.
Neither vulnerability requires authentication. There is no public report of exploitation or confirmed compromise at the time of the advisory, although mySites.guru said about 95% of the Gridbox sites it monitored were running an affected version.
- Update every Joomla installation using Gridbox to
2.20.4.2. - After updating, check for unfamiliar administrator accounts and consider resetting administrator passwords on sites that were exposed.
Originally reported by mySites.guru.