CVE-2026-102780
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Joomla extension TF Content versions 2.9.0–2.9.4 unconditionally authorizes creation and editing in its public RecordController. A guest can obtain a valid token from Joomla's public login form and modify any record, including mass-assigning published, access, and created_by fields.
Risk Assessment
An unauthenticated user can publish and modify content and change access permissions, leading to data integrity violations and potential information disclosure.
Recommendation
Update the TF Content extension to a version later than 2.9.4 that fixes the authorization and mass assignment issue.
Other vulnerabilities in TF Content
Original NVD description (English source)
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning `published`, `access`, and `created_by`.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS