CVE-2026-102779
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The Joomla extension TF Content versions 2.9.0 - 2.9.4 exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.
Risk Assessment
Unauthenticated task execution may allow an attacker to trigger arbitrary configured actions, leading to unauthorized changes or data corruption.
Recommendation
Update the TF Content extension to a version that requires authentication, ACL, CSRF, and other protections for the `records.custom_action` task.
Other vulnerabilities in TF Content
Original NVD description (English source)
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS