The vulnerability exists in the front‑end Submissions view of the Convert Forms extension for Joomla, where access control is not enforced for unauthenticated visitors. Because the view lists form submissions, a user without credentials can view potentially sensitive data collected through any form. The weakness is a classic information‑leak scenario (CWE‑200) compounded by improper privilege enforcement (CWE‑284). If exploited, attackers could read private submissions that may include personal or sensitive information, thereby violating privacy. The description does not restrict the type of data exposed, so it could be any information stored in the submissions.

Vendors affected are tassos.gr’s Convert Forms extension for Joomla. All sites running any version from 2.5.0 through 5.2.2 are susceptible. No other product or version is listed as affected.

The CVSS score of 8.2 indicates a high severity, while the EPSS score is less than 1%, suggesting that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a direct HTTP request to the submissions listing page, which does not require authentication; an attacker can access the URL and retrieve the data. Because the flaw is an information disclosure without privilege escalation, it can expose the private submissions to anyone who can reach the endpoint, but it does not enable further compromise of the host.