{"id":"CVE-2026-102784","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-102784","generatedAt":"2026-10-28T05:28:19.802Z","title":"Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and…","description":"Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request input. A GET request can therefore reach the action without the trait checking a token. The action still requires core.tools , but that is the victim’s permission check; it does not prove that the privileged user intended the request.","published":"2026-10-08T13:17:12.000Z","lastModified":"2026-10-08T21:07:57.000Z","status":"Awaiting Analysis","sourceIdentifier":"security@joomla.org","cvss":{"version":"4.0","score":8.7,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-352"],"affected":[],"epss":{"score":0.00171,"percentile":0.06465,"date":"2026-10-27","history":[{"date":"2026-10-09","score":0.00171,"percentile":0.05941}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-08T13:17:12.000Z","detail":{"score":"8.7","severity":"HIGH","publishedAt":"2026-10-08T13:17:12.023Z"},"summary":"New CVE, high severity (CVSS 8.7)."}],"references":[{"url":"https://www.balbooa.com/gridbox","source":"security@joomla.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102784","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}