The Gridbox extension for Joomla, developed by balbooa.com, has been identified as containing multiple CSRF vectors (CWE‑352) in its administrative interface for all releases prior to version 2.20.2. This weakness permits the forging of authenticated requests, allowing an attacker to cause the administrator to perform actions that the extension’s interface permits. The flaw does not specify which actions can be performed, but it undermines the integrity of administrative operations in the extension.

Any Joomla installation that includes the balbooa.com Gridbox extension with a version earlier than 2.20.2 is potentially vulnerable. Sites that have upgraded to Gridbox 2.20.2 or newer are not affected.

The CVSS score of 7.3 indicates a high level of severity, whereas the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can trigger forged requests by coaxing a logged‑in administrator or a user with an active admin session to visit a malicious URL or submit a forged form. Successful exploitation would enable the attacker to execute any administrative function that the authenticated user is authorized to perform, potentially compromising data integrity and other administrative controls.