CVE-2026-77026: CWE-602: Client-Side Enforcement of Server-Side Security in tassos.gr Convert Forms extension for Joomla
Description
A vulnerability in the Convert Forms extension for Joomla (versions 1.0.0 through 5.2.5) allows unauthenticated visitors to bypass access control on the front-end Submissions view, enabling them to list form submissions. This is due to client-side enforcement of security that should be handled server-side.
CVSS v4.0
Score 6.9medium
Affected software
tassos.gr
Convert Forms extension for Joomla
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-77026 is a client-controlled validation bypass vulnerability in the Convert Forms extension for Joomla, specifically affecting versions from 1.0.0 up to and including 5.2.5. The issue arises because the front-end Submissions view does not enforce proper access control on the server side, allowing unauthenticated users to list form submissions. This vulnerability is categorized under CWE-602 (Client-Side Enforcement of Server-Side Security). The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges required, no user interaction, and low impact on confidentiality and availability.
Potential Impact
An unauthenticated attacker can access and list submissions of forms on the affected Joomla extension, potentially exposing sensitive data submitted through these forms. This could lead to information disclosure but does not require authentication or user interaction.
Mitigation Recommendations
No official patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Submissions view or disable the extension if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Joomla
- Date Reserved
- 2026-08-20T08:36:08.428Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a86e0f3acd9273b498384c6
Added to database: 08/20/2026, 11:11:47 UTC
Last enriched: 09/11/2026, 05:18:22 UTC
Last updated: 10/04/2026, 18:53:18 UTC
Views: 42
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.