CVE-2026-102780

Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4

View on CVE.org

Published Oct 5, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning `published`, `access`, and `created_by`.

Analysis

Technical impact

The vulnerability resides in the public RecordController of the TF Content extension where the supplied jform array is accepted without filtering, allowing creation and editing of any record. Because the controller accepts an arbitrary record ID and saves it, a guest can craft a request that changes the status, access level, or ownership of any content row. This mass assignment effectively lets an unauthenticated user cause arbitrary content to be published, hidden, or attributed to any user.

Affected Systems

Joomla installations running the TF Content extension from joomlafry.com, versions 2.9.0 through 2.9.4, are affected.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. The exploit requires only a standard guest login to obtain a Joomla session token, enabling a crafted request that changes the status, access level, or owner of any record. While EPSS data is unavailable, the lack of formal parameter validation in the front‑end controller allows attackers to trigger the vulnerability without special conditions. The vulnerability is not listed in CISA KEV, but it poses significant damage potential due to unauthorized content manipulation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

joomlafry.com

TF Content for Joomla

unaffected

Version	Status	Constraints
`2.9.0-2.9.4`	affected	—

Configuration 1 [-]

cpe:2.3:a:techfry:tf_content:*:*:*:*:*:joomla\!:*:*

No data.

Vendor Product Versions

Joomlafry.com

Tf Content For Joomla

Version	Status	Scheme	Platform
`[2.9.0,2.9.4]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the TF Content extension to the latest version that eliminates the unchecked mass assignment in the RecordController.
If no patch is available, restrict front‑end access to the extension’s controllers by removing Create/Edit permissions from the Public group and granting them only to Administrators and authorized editors.
Monitor content publication changes through Joomla’s audit log or an external monitoring system and trigger alerts when unexpected status or ownership changes occur.

Generated by OpenCVE AI on October 5, 2026 at 17:22 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.290% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.joomlafry.com/

History

Oct 14, 2026 7:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Techfry Techfry tf Content
CPEs		cpe:2.3:a:techfry:tf_content::::::joomla\!::*
Vendors & Products		Techfry Techfry tf Content
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Oct 6, 2026 9:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Joomlafry.com Joomlafry.com tf Content For Joomla
Vendors & Products		Joomlafry.com Joomlafry.com tf Content For Joomla

Oct 5, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 5, 2026 4:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning `published`, `access`, and `created_by`.
Title		Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4
Weaknesses		CWE-862 CWE-915
References		https://www.joomlafry.com/
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}`