CVE-2026-66488 is a vulnerability in the balbooa.com Gridbox extension for Joomla that allows an attacker to bypass payment controls in versions up to 2.20.1. The vulnerability is classified under CWE-285 (Improper Authorization). The CVSS v3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. There is no vendor advisory or patch available at this time.

The vulnerability enables an attacker to bypass payment mechanisms, potentially allowing unauthorized transactions or actions that should require payment authorization. The integrity of payment processes can be compromised, but confidentiality and availability are not affected. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor official balbooa.com and Joomla security advisories for updates. No specific temporary mitigations are provided.