CVE-2026-65890 describes an unauthenticated SQL injection vulnerability in the balbooa.com Gridbox extension for Joomla. Versions from 1.0.0 up to and including 2.20.1 are affected. The vulnerability allows attackers without any privileges or user interaction to inject SQL commands via multiple vectors, potentially leading to high-impact consequences such as data exposure or modification. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official remediation or patch has been documented at this time.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, data modification, or disruption of service. The high CVSS score reflects the critical nature of this vulnerability due to its ease of exploitation and significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the Gridbox extension to mitigate risk. Monitor official balbooa.com and Joomla advisories for updates.