CVE-2026-102780

Summary

Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public RecordController. Its shared frontend save controller accepts the raw jform array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning published, access, and created_by.

Affected Software

Weaknesses

• CWE-862: CWE-862 Missing Authorisation
• CWE-915: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes i.e. mass-assignment

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.joomlafry.com/

• ←Previous
• Next→