CVE-2026-77026

MediumCVSS 6.9

Published: 20/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

In the Convert Forms extension for Joomla (versions < 5.2.5), the front-end Submissions view lacks access control. An unauthenticated visitor can list a form's submissions.

Risk Assessment

Unauthorized access to submissions may lead to disclosure of personal or sensitive information submitted via forms.

Recommendation

Upgrade the Convert Forms extension to version 5.2.5 or later, which fixes the issue.

Other vulnerabilities in Convert Forms

CVE-2026-65758High
Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions.

Original NVD description (English source)

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions.