Which versions of Convert Forms are affected by CVE-2026-65758?

The Convert Forms extension for Joomla (versions 2.5.0-5.2.2) contains an unauthenticated information disclosure vulnerability allowing any visitor to access stored form submissions containing…

How to fix or mitigate CVE-2026-65758?

Within 24 hours, inventory all Joomla installations running Convert Forms versions 2.5.0 through 5.2.2 and immediately disable or restrict front-end access to the Submissions view using web server configuration (Apache .htaccess or nginx location blocks). Within 7 days, audit server logs for unauthorized access to submission endpoints, conduct a data exposure assessment to determine scope of access, and prepare breach notifications for affected users. Within 30 days, identify and deploy a replacement form solution with proper access controls and plan migration away from Convert Forms, while monitoring vendor security advisories for any future patch release.

Convert Forms CVE-2026-65758

Q: What is the CVSS score of CVE-2026-65758?

CVE-2026-65758 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-47899 HIGH

Information Exposure (CWE-200)

2026-07-23 security@joomla.org

GHSA-jvm5-rgvg-rcjv

Information Disclosure

8.2

CVSS 4.0 · Vendor: joomla

Severity by source

Vendor (joomla) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated remote read of stored form data with no interaction gives AV:N/PR:N/UI:N; missing access check makes it low-complexity; only confidentiality is affected (C:H, I/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (joomla).

CVSS VectorVendor: joomla

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:23 vuln.today

CVSS changed

Jul 23, 2026 - 18:22 NVD

8.2 (HIGH)

CVE Published

Jul 23, 2026 - 10:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 23, 2026 - 10:16 cve.org

HIGH 8.2

DescriptionCVE.org

The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions.

AnalysisAI

Unauthenticated information disclosure in the Convert Forms extension for Joomla (versions 2.5.0 through 5.2.2) lets any anonymous visitor enumerate and read a form's stored submissions because the front-end Submissions view fails to enforce access control. Submitted data frequently contains PII such as names, email addresses, phone numbers, and free-text messages, so exposure can be significant. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

Convert Forms is a commercial drag-and-drop form-builder extension by Tassos Marinos (tassos.gr) for the Joomla CMS, used to create contact, subscription, and lead-generation forms whose responses are stored server-side and normally reviewed through an authenticated back-end. The vulnerability is a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) missing-authorization flaw in the component's front-end Submissions view: the view renders stored submission records without checking whether the requesting session is authenticated or authorized, so the access-control gate that should restrict this data to administrators is simply absent from that code path.

RemediationAI

No vendor-released fixed version was identified in the provided data; the last affected version is 5.2.2, so a patched release above 5.2.2 is the expected fix but is not independently confirmed here - check the vendor advisory and update to the current release at https://www.tassos.gr/joomla-extensions/convert-forms and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-65758 before upgrading. As an interim compensating control until a confirmed patched version is applied, restrict or block front-end access to the Convert Forms Submissions view (for example, deny the submissions view route/task at the web server or WAF layer, or via a Joomla access-level restriction), accepting the trade-off that any legitimate front-end submission-review workflow will break. Where feasible, purge or minimize sensitive data retained in stored submissions to reduce exposure if the endpoint is reached.