--- title: "Security Update: Unauthorized Access to Form Submissions in Convert Forms" description: "On July 20th, 2026, security researcher Krzysztof Zając of CERT Polska responsibly reported a missing access control issue in the front-end Submissio" url: "https://www.tassos.gr/blog/company/security-update-unauthorized-access-form-submissions-convert-forms" date: "2026-07-30T21:22:47+00:00" language: "en-GB" --- # Security Update: Unauthorized Access to Form Submissions in Convert Forms ![Theo Nikitaras](https://www.gravatar.com/avatar/2cf785453cf850d5791fd350eb196fae?s=48) Theo Nikitaras Follow Published in [Company News](https://www.tassos.gr/blog/company) 4 days ago 4 min read Last updated 4 days ago ![Security Update: Unauthorized Access to Form Submissions in Convert Forms](https://www.tassos.gr/images/2026/07/security_update123.png)On July 20th, 2026, security researcher **Krzysztof Zając** of [CERT Polska](https://cert.pl) responsibly reported a missing access control issue in the front-end Submissions view of **Convert Forms**, through the Joomla Security Strike Team. The issue is tracked as [CVE-2026-65758](https://nvd.nist.gov/vuln/detail/CVE-2026-65758). We reviewed the code, enforced proper access control on that view, and shipped a patched version. The issue is fully resolved in **Convert Forms 5.2.4**. ## [What was the issue?](#what-was-the-issue) Convert Forms can display a form's submissions on the front end through the **Submissions** menu item type, so that people can review what they have sent you. That view checked which menu item was being used, but it never checked *who* was asking, and it did not limit the results to the submissions belonging to the visitor. As a result, a visitor could reach the submissions list without logging in, by pointing any published Convert Forms menu item at that view, including an ordinary **Form** menu item. The list itself only shows an ID, a date and a status. However, the search box on that page matches against the stored submission data and reports how many results it found. That count could be used to confirm, piece by piece, what a submission actually contains, such as names, email addresses and message text. Submissions that were never confirmed were included as well. The fix requires a logged-in user, unless the menu item is deliberately configured to show a public list, and it now scopes the results to the person viewing the page by default. We have no reports or evidence that this was exploited in the wild. ## [Who is affected?](#who-is-affected) This one is specific to **Convert Forms**. It lives in the component itself, not in the shared Tassos Framework plugin, so no other Tassos extension is affected by it. Your site is affected if all of the following are true: - You run **Convert Forms 2.5.0 up to and including 5.2.2**. Version 2.5.0 introduced the front-end Submissions menu item type - You have at least one **published Convert Forms menu item** that a visitor can reach, of either the Form or the Submissions type - Your forms save submissions to the database If your forms are published only through modules, plugins or shortcodes, and you have no Convert Forms menu item at all, the view could not be reached. One note on the range: the search box on the submissions page was added in **4.2.4**. On older versions the exposure is limited to the listing itself. ## [What you need to do](#what-you-need-to-do) Update Convert Forms to the version below, or later. | Extension | Joomla 4 / 5 / 6 | Joomla 3 | |---|---|---| | Convert Forms | [v5.2.4](https://www.tassos.gr/releases/convert-forms/convert-forms-5-2-4) or later | [v4.4.16](https://www.tassos.gr/releases/convert-forms/convert-forms-4-4-16) or later | Convert Forms 5.2.3 contains the same fix, but it was withdrawn shortly after release because of an unrelated error affecting sites that also run Advanced Custom Fields. Please install **5.2.4**. ### [Verify your installation](#verify-your-installation) After updating, confirm you are running a patched version: 1. Log in to your Joomla Administrator 2. Go to **System → Manage → Extensions** 3. Search for **Convert Forms** and confirm the version is **5.2.4 or later** If it is, you are protected. ### [If you cannot update right away](#if-you-cannot-update-right-away) Updating is the proper fix, but if you need to buy yourself some time, you can close the door in the meantime: 1. Log in to your Joomla Administrator 2. Go to **Menus** and open each menu item that points to Convert Forms 3. Set its **Access** level to a level that guests do not have, such as Registered, or unpublish the menu item Keep in mind that this also hides your forms from visitors, so treat it as a temporary measure until you can update. ## [Should you check anything else?](#should-you-check-anything-else) There is no reliable way to tell from the outside whether anyone used this on your site, because the requests look like ordinary page views. If you keep web server access logs and want to have a look, search them for requests containing `view=submissions` that came from visitors who were not logged in. If you find something that worries you, open a support ticket and we will help you make sense of it. ## [Responsible disclosure](#responsible-disclosure) Our thanks to **Krzysztof Zając** of **CERT Polska** for reporting this to us responsibly, and to the **Joomla Security Strike Team** for coordinating the disclosure. Security remains a top priority for us. If you need help updating, or you have any questions about this update, open a support ticket and we will assist you promptly.