CVE-2026-102779: Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task records.customaction without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated guest can trigger it remotely. Exploitation does not require authentication, ACL permissions, CSRF validation, a task-trigger condition, content binding, or a cron token.
What must an attacker know or provide to trigger a task?
The attacker needs the numeric ID of a published TF Content task. They can then cause the component to dispatch that task's configured executor immediately.
Which deployments are affected?
TF Content versions 2.9.0 through 2.9.4 are affected when published automation tasks are present. The exposed site task is records.custom_action.