Convert Forms (com_convertforms) 5.2.3 to 5.2.4 (Joomla 4/5/6 branch) - Unauthenticated Client-Controlled Validation Bypass (CAPTCHA and field validation bypass, CVE-2026-77026)

Convert Forms 5.2.3 and 5.2.4 on the Joomla 4/5/6 branch let an unauthenticated visitor bypass CAPTCHA and other field validations by claiming the fields were hidden by Conditional Logic. Because the form decides which validation rules apply on the client side, a crafted submission can assert that a required or CAPTCHA-protected field was conditionally hidden and skip its validation entirely. The practical impact is spam and unvalidated data reaching your forms, your notification emails and any downstream integrations. It does not expose existing submissions. Tassos Marinos fixed it in Convert Forms 5.2.5, released 20 August 2026. Update to 5.2.5 or later. Sites on the Joomla 3 branch need 4.4.17 instead, which carries the same fix. CVE-2026-77026, CVSS 4.0 base 6.9 Medium (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L), credited to Murrez. Note: the published CVE description text actually describes an earlier and different flaw, unauthorised front-end viewing of form submissions, which was fixed back in 5.2.3 and is covered by a separate rule. The CVE title, its affected version range and its CVSS vector all match this validation bypass rather than that disclosure.

Affected versions: ≥ 5.2.3 and < 5.2.5

Official record: cve.org · NVD

Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.

Affected extensions and versions