CVE-2026-77026 is a client-controlled validation bypass vulnerability in the Convert Forms extension for Joomla, specifically affecting versions from 1.0.0 up to and including 5.2.5. The issue arises because the front-end Submissions view does not enforce server-side access control, allowing unauthenticated users to list form submissions. This is categorized under CWE-602, which involves client-side enforcement of server-side security, indicating that security checks are improperly delegated to the client side rather than enforced on the server.

An unauthenticated attacker can access and list form submissions through the front-end interface, potentially exposing sensitive data submitted via forms. This exposure occurs without requiring any authentication or privileges, increasing the risk of data leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the submissions view through other means such as web server access controls or disabling the affected functionality if feasible.