CVE-2026-102780: Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public RecordController. Its shared frontend save controller accepts the raw jform array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning published, access, and createdby.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated guest can exploit it. The guest can obtain a valid token from Joomla's public login form and use it to modify TF Content records.
What level of access or interaction does an attacker need?
The attacker does not need an authenticated account. They need access to the public Joomla login form to obtain a valid token, then can submit requests to the extension's frontend save controller.
What can an attacker change?
An attacker can modify any TF Content row by selecting an existing record ID. They can also mass-assign properties including published, access, and created_by.
Which versions are affected?
TF Content versions 2.9.0 through 2.9.4 are affected.