CVE-2026-65758 describes an improper access control vulnerability in the Convert Forms extension for Joomla, affecting versions 2.5.0 to 5.2.2. The front-end Submissions view does not enforce access control, enabling unauthenticated users to access and list form submissions. This results in exposure of sensitive data submitted through forms. The vulnerability is categorized under CWE-284 and CWE-200. There is no vendor advisory or patch available at this time, and no known exploits have been reported in the wild.

An attacker without authentication can access the submissions of forms on affected Joomla sites using the Convert Forms extension, potentially exposing sensitive user data collected via these forms. This compromises confidentiality and may lead to privacy violations or data leakage. The vulnerability does not require user interaction or privileges, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Submissions view by implementing custom access controls or disabling the front-end submissions listing if possible. Monitor for vendor updates regarding patches or official mitigations.