The vulnerability allows an unauthenticated attacker to delete submission or field files from the Gridbox extension for Joomla. Because the deletion endpoint does not enforce proper authorization, the attacker can remove crucial data, potentially leading to loss of content or disrupting site functionality. This represents a significant integrity problem, as files that belong to administrators or users can be permanently removed.

The affected product is the Gridbox extension from balbooa.com, designed for Joomla. Versions earlier than 2.20.5.0 are impacted. No further version granularity is provided in the CVE data.

The CVSS score of 6.9 indicates moderate severity. With no EPSS score available, the exploitation probability is unclear but the flaw is exploitable by anyone who can reach the deletion endpoint, as the title says it is unauthenticated. The vulnerability is not currently listed in the CISA KEV catalog, reducing its immediacy in the known exploited catalog but still representing a valid risk to system integrity.