CVE-2026-65887

The Gridbox extension for Joomla versions prior to 2.20.2 is vulnerable to an unauthenticated arbitrary password reset, enabling attackers to reset passwords for any user account, except for super admins. This flaw poses a significant risk as it allows unauthorized access to user accounts, potentially leading to data breaches or account takeovers. Joomla site administrators using the affected extension should prioritize applying the update to mitigate this security risk.