CVE-2026-77026 MEDIUM

CVE-2026-77026: Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5

Vendor Tassos.gr
Product Convert Forms extension for Joomla
Weakness CWE-602 · Client-side enforcement
Published August 20, 2026
Last update August 20, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions.

Explanation of Vulnerability in Simple Terms

02Summary

The Convert Forms extension for Joomla contains a vulnerability that allows attackers to modify form data without authorization. An attacker can send a crafted network request to alter form submissions or settings. This affects versions 1.0.0 through 5.2.5. Site administrators should update to a patched version when available.

What an attacker can do

03Attacker Capabilities

Modify form data or settings without authorization via network requests.

Potential impact on your site

04Site Impact

Form submissions may be altered or corrupted; user data integrity cannot be guaranteed.

Conditions required to exploit

05Prerequisites

Network access to the Joomla site; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 20, 2026 CVE published
August 20, 2026 Record updated