CVE-2026-65888 describes an improper access control vulnerability in the balbooa.com Gridbox extension for Joomla, affecting versions 1.0.0 through 2.20.1. The vulnerability resides in the socialLogin method, which permits an attacker to authenticate as any user on the affected site without proper authorization checks. This results in a complete account takeover risk. The vulnerability is rated critical with a CVSS 4.0 score of 10, indicating network exploitable, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an unauthenticated attacker to log in as any user on the target Joomla site using the Gridbox extension, leading to full account takeover. This compromises user confidentiality, integrity, and availability of the affected system. Given the critical CVSS score, the impact is severe, potentially allowing attackers to perform any actions as the compromised user, including administrative functions if the targeted account has such privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected extension and monitor for suspicious login activity. Consider disabling the socialLogin feature if feasible. Do not rely on generic mitigations; await vendor-provided patches or official workarounds.