CVE-2026-65887 is an improper access control vulnerability in the balbooa.com Gridbox extension for Joomla, affecting versions 1.0.0 through 2.20.1. The flaw resides in the resetPassword method, which permits unauthenticated actors to reset passwords for any user account except super administrators. This allows attackers to gain unauthorized access and perform actions as those users. The vulnerability has a critical severity with a CVSS 4.0 score of 10, indicating network exploitable, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official fix or patch is currently documented.

Exploitation of this vulnerability allows unauthenticated attackers to reset passwords of any user except super administrators, leading to unauthorized access and potential full compromise of affected user accounts. This can result in data exposure, unauthorized actions, and potential disruption of services associated with those accounts. The vulnerability does not affect super administrator accounts, limiting the highest privilege compromise but still poses a critical risk to other user accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Gridbox extension and monitor for suspicious activity. Consider disabling or limiting the use of the resetPassword functionality if possible. Follow updates from balbooa.com and Joomla for any forthcoming patches or official mitigations.