Gridbox 2.20.1: suspected CVE-2026-61425 auth bypass via store.register

Hello,
We are using Balbooa Gridbox on a production Joomla site and have updated to Gridbox 2.20.1, which according to your announcement and changelog is supposed to fix the authentication bypass vulnerability CVE-2026-61425.

However, we are still seeing behavior that looks very similar to exploitation of this vulnerability.

Environment
- CMS: Joomla (exact version available on request).
- Gridbox: component / package / template are all reported as 2.20.1 in the Joomla Extensions manager.
- Balbooa Forms: 2.2.1 (known vulnerable to CVE-2026-56291, but this ticket is specifically about Gridbox).
- Web stack: nginx + Apache, Apache handles PHP, and .htaccess is in use for Joomla.

Observed issue
In the web server access log we see the following request:
109.107.178.102 - - [28/Jul/2026:23:02:19 +0500] "POST /index.php?option=com_gridbox&task=store.register HTTP/1.1" 200 15 "https://*********:443/" "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:51.0) Gecko/20100101 Firefox/51.0"
Immediately after this request, a new Joomla user with Super User / administrator privileges appears in the database. The registration timestamp matches this POST request.

Important details:
- We do not use the Gridbox Store / shop functionality at all, but the endpoint index.php?option=com_gridbox&task=store.register is still publicly accessible on the frontend.
- Similar suspicious activity has been seen around other Gridbox endpoints.
- After we temporarily blocked this URL (and a few other endpoints) at the web server level, no new unexpected administrator accounts have appeared.

Why we suspect CVE-2026-61425
Public descriptions of CVE-2026-61425 state that Gridbox is vulnerable to an authentication bypass that can lead to full admin access. The vulnerability is reported as affecting Gridbox up to certain versions, and your materials say that 2.20.1 includes a security fix for this issue.

The actual behavior we observe (creation of a Super User directly after a POST to task=store.register) suggests that either:
- the vulnerability is still exploitable in some configuration on 2.20.1, or
- there is a related or similar issue around the registration / store endpoints that remains open.

Questions
1) Can you confirm that Gridbox 2.20.1 fully fixes CVE-2026-61425 for all public endpoints, including task=store.register?
2) Is there any known scenario on 2.20.1 where a request to store.register from the frontend could result in creating or elevating a user to administrator / Super User?
3) What is the recommended way to fully disable the Store / shop module and its endpoints (store.register, uploader.savePhotoEditorImage) on a site that does not use the shop functionality at all? Ideally via component configuration, not only by blocking URLs in the web server.
4) If there is any residual risk around CVE-2026-61425 on 2.20.1, can you provide an updated patch or hardening guidance?

Temporary mitigation
For now, we have put in temporary web server rules to block these requests:
/index.php?option=com_gridbox&task=store.register
/index.php?option=com_gridbox&task=uploader.savePhotoEditorImage
/index.php?option=com_baforms&task=form.uploadAttachmentFile

This stopped the creation of new unexpected Super Users, but it is clearly a temporary workaround, not a proper long-term fix. We would like to resolve this correctly at the application level.

Thank you in advance for your assistance.