Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2026-102780: TF Content for Joomla lets anyone edit or publish records
CVE-2026-102780 · published 13 days ago
Summary
The TF Content extension for Joomla allows anyone, even without logging in, to change or publish content items. A visitor can use a public form token to modify any record, including changing its published status or author. Apply the vendor's update or disable the extension until it is patched.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| joomlafry.com | tf content for joomla | 2.9.0-2.9.4 |
| techfry | tf_content |
>= 2.9.0, <= 2.9.4 cpe:2.3:a:techfry:tf_content:*:*:*:*:*:joomla\!:*:* |
Original advisory text
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning `published`, `access`, and `created_by`.
References
- https://www.joomlafry.com/ Product
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-862Missing Authorization
CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes
Timeline
Published5 Oct 2026
Updated15 Oct 2026
First seen5 Oct 2026
Track software like this
Free during beta