Unauthenticated Cross-Record Publication and Mass Assignment in Joomla Extension by joomlafry.com
CVE-2026-102780

6.9MEDIUM

Key Information:

Vendor

Joomlafry.com

Status
Tf Content For Joomla
Vendor
CVE Published:
5 October 2026

What is CVE-2026-102780?

The Joomla extension by joomlafry.com, TF Content versions 2.9.0 to 2.9.4, contains a critical flaw that allows unauthenticated users to create and edit records without authorization. The affected save controller exposes a raw jform array that lacks the necessary filtering of properties, enabling guests to obtain a valid token from Joomla's public login and manipulate any record. This includes mass assignment of sensitive fields such as published, access, and created_by, posing significant security risks to Joomla users.

Affected Version(s)

TF Content for Joomla 2.9.0-2.9.4

References

https://www.joomlafry.com/
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Łukasz Rybak
.