CVE-2026-102779 Missing authorization in TF Content for Joomla
Unauthenticated attackers can force execution of published automation tasks in TF Content for Joomla, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-102779?
CVE-2026-102779 is a medium-severity missing authorization vulnerability in joomlafry.com TF Content for Joomla, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.
Weakness: CWE-862
Which versions are affected by CVE-2026-102779?
It affects 1 product.
Products include Techfry Tf Content.
How do I fix CVE-2026-102779?
No fix has been published for CVE-2026-102779 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-102779 being exploited?
There is no known exploitation of CVE-2026-102779 in the wild and no public exploit code.
Other vulnerabilities in joomlafry.com TF Content for Joomla
Sources
Also known as GHSA-hqjq-hvr2-rrg3.