CVE-2026-102780
Received Received - Intake

Unauthenticated Mass Assignment in TF Content Joomla Extension

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: Joomla! Project

Description
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning `published`, `access`, and `created_by`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-102780
EUVD
EUVD-2026-92452

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joomlafry.com TF Content for Joomla 2.9.0-2.9.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the TF Content Joomla extension versions 2.9.0 to 2.9.4. It allows unauthenticated users to create or edit records without proper authorization. The flaw exists because the extension does not validate or filter user input properly, enabling attackers to modify any record, including changing sensitive fields like publication status or author details.

Detection Guidance

Check Joomla extensions for TF Content versions 2.9.0 to 2.9.4. Review server logs for unauthorized record modifications or mass assignments in TF Content. Inspect database tables for unexpected changes to published, access, or created_by fields.

Impact Analysis

An attacker could exploit this to publish unauthorized content, alter existing records, or change access permissions. This could lead to misinformation, data corruption, or unauthorized access to sensitive information. The impact depends on the data managed by the Joomla site.

Compliance Impact

This vulnerability could lead to unauthorized data modifications or access, violating integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized changes to records may result in non-compliance, potential data breaches, and legal consequences depending on the data processed by the Joomla site.

Mitigation Strategies

Update TF Content to the latest version. Disable public access to the RecordController endpoint. Implement strict input validation for form submissions. Review and audit database records for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102780. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart