An unauthenticated arbitrary password reset vulnerability in the balbooa.com Gridbox extension for Joomla permits attackers to take over user accounts.

This is an improper access control flaw (CWE-284) located in the resetPassword method. The implementation allows unauthenticated actors to trigger password resets for arbitrary users, excluding super administrators, facilitating unauthorized account access.

This flaw enables attackers to compromise virtually any non-administrative user account on the affected site. This leads to unauthorized access to sensitive user information, potential data theft, and the ability to perform actions on behalf of legitimate users. The CVSS score of 10.0 reflects the critical nature of this unauthorized access capability.

Immediate Action: Update the balbooa.com Gridbox extension for Joomla to version 2.20.2 or later.

Proactive Monitoring: Monitor authentication logs for anomalous password reset requests or spikes in account takeover activity.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block suspicious requests directed at the password reset endpoint.

Public Exploit Available: Unknown

The ability for an unauthenticated actor to reset user passwords necessitates an immediate update to the latest version of the Gridbox extension. Administrators should treat this as a high priority incident to prevent widespread account compromise across their user base.