CVE-2026-102780 Missing authorization in TF Content for Joomla
Unauthenticated attackers can modify any content record and escalate privileges by mass-assigning fields in the TF Content Joomla extension.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-102780?
CVE-2026-102780 is a medium-severity missing authorization vulnerability in joomlafry.com TF Content for Joomla, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning `published`, `access`, and `created_by`.
Which versions are affected by CVE-2026-102780?
It affects 1 product.
Products include Techfry Tf Content.
How do I fix CVE-2026-102780?
No fix has been published for CVE-2026-102780 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-102780 being exploited?
There is no known exploitation of CVE-2026-102780 in the wild and no public exploit code.
Other vulnerabilities in joomlafry.com TF Content for Joomla
Sources
Also known as GHSA-5q6m-pwqm-wmc9.