The Gridbox extension for Joomla contains an improper access control vulnerability (CWE-284) in its resetPassword method. This flaw permits unauthenticated actors to reset passwords for any user account except super administrators. Exploitation allows attackers to gain unauthorized access to affected user accounts, potentially leading to account takeover and unauthorized actions within the Joomla site. The vulnerability is present in versions 1.0.0 through 2.20.1 of the Gridbox extension.

Successful exploitation results in unauthorized password resets for any user except super admins, enabling attackers to log in as those users and perform actions with their privileges. This compromises user account integrity and site security. The vulnerability does not affect super admin accounts, limiting the scope of full administrative takeover but still poses a critical risk to other user accounts.

No official patch or remediation is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates and apply any official fixes once available. Until then, restrict access to the affected extension and consider disabling it if possible to prevent exploitation.