CVE-2026-65758: Form Submissions Information Disclosure

CVE-2026-65758 Overview

CVE-2026-65758 is an information disclosure vulnerability affecting the Convert Forms Joomla extension developed by Tassos. The front-end Submissions view fails to enforce access control checks. An unauthenticated visitor can list a form's submissions by requesting the view directly. This exposes user-submitted data, including any personal or business information collected through affected forms. The weakness maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can enumerate and read form submissions containing potentially sensitive personal data collected by any Joomla site using the affected Convert Forms extension.

Affected Products

Tassos Convert Forms extension for Joomla
Joomla sites exposing the front-end Submissions view
Web applications relying on Convert Forms for data collection

Discovery Timeline

2026-07-23 - CVE-2026-65758 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-65758

Vulnerability Analysis

The Convert Forms extension provides a front-end Submissions view intended for administrators or authorized users to review data submitted through forms. The controller responsible for rendering this view does not verify the requesting user's authentication state or role. When a visitor navigates to the Submissions view URL, the extension returns the stored submission records without validating access.

This is a broken access control weakness. The vulnerable component processes the request, queries the submissions table, and renders results regardless of the session context. Attackers can iterate over form identifiers to enumerate submissions across every form configured on the site.

The consequences depend on what data each form collects. Contact forms, registration forms, and support forms commonly capture names, email addresses, phone numbers, messages, and file uploads. Exposure of these records violates data protection obligations and enables downstream phishing, credential stuffing, and social engineering attacks.

Root Cause

The root cause is a missing authorization check in the front-end submissions controller. The code path renders submission data without calling the Joomla access control layer to confirm the user holds a role permitted to view the records.

Attack Vector

An unauthenticated attacker sends an HTTP GET request to the Joomla site invoking the Convert Forms front-end Submissions view with a target form identifier. The server returns the submission list in the response. No credentials, tokens, or user interaction are required.

No verified public exploit code is available at this time. See the Tassos Convert Forms product page for vendor information.

Detection Methods for CVE-2026-65758

Indicators of Compromise

Unauthenticated HTTP requests targeting Convert Forms view parameters such as option=com_convertforms combined with a submissions view identifier
Repeated requests from a single source enumerating sequential form identifiers
Unexpected outbound traffic patterns following bulk read access to form submission endpoints
Web server access logs showing 200 responses to submissions view URLs from non-administrative IP ranges

Detection Strategies

Review Joomla and web server logs for requests referencing the Convert Forms component paired with a submissions view parameter
Deploy web application firewall rules that block or alert on unauthenticated requests to component views handling stored data
Correlate access logs against authenticated session activity to identify anonymous reads of restricted views

Monitoring Recommendations

Enable verbose access logging on Joomla instances running Convert Forms and forward logs to a central SIEM
Alert on high-volume requests targeting the same component from a single IP address within short time windows
Baseline normal traffic to /index.php?option=com_convertforms paths and flag deviations

How to Mitigate CVE-2026-65758

Immediate Actions Required

Update the Convert Forms extension to the latest version published by Tassos as soon as it is released
Audit web server access logs for prior unauthenticated access to the Submissions view and identify exposed records
Notify affected users if submission data containing personal information was disclosed
Restrict access to the Convert Forms component at the web server or WAF layer until a patch is applied

Patch Information

Refer to the vendor advisory on the Tassos Convert Forms product page for the fixed version and release notes. Apply the update through the Joomla extension manager and verify the version reported in the administrator panel after upgrade.

Workarounds

Block requests to Convert Forms submissions view URLs at the web server or reverse proxy for unauthenticated visitors
Disable the Convert Forms extension in the Joomla administrator panel until the patched release is deployed
Use .htaccess or Nginx location rules to deny anonymous access to component endpoints handling submission data

bash

# Example Apache rule to deny anonymous access to Convert Forms submissions view
<LocationMatch "^/index\.php">
    SetEnvIfNoCase Query_String "option=com_convertforms.*view=submissions" block_cf
    Require all granted
    Require not env block_cf
</LocationMatch>