CVE-2026-102780
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4
Published Oct 5, 2026 · updated Oct 14, 2026 · joomlafry.com TF Content for Joomla
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public . Its shared frontend save controller accepts the raw array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning , , and .
Timeline
Detection, updates, and resolution for this record.
Oct 5, 2026 · NIST NVD
Detected
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public . Its shared frontend save controller accepts the raw array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A
Oct 14, 2026 · NIST NVD
Updated
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public . Its shared frontend save controller accepts the raw array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A
Affected
- cpe techfry/tf contentversion unspecified
- vendor joomlafry.com TF Content for Joomlaversion unspecified
Sources
- CIRCL Vulnerability LookupCVE-2026-102780
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public . Its shared frontend save controller accepts the raw array, assigns the
vulnerability.circl.lu - CVE.orgCVE-2026-102780
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-102780
30-day exploitation probability 0.3%
first.org - NIST NVDCVE-2026-102780
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public . Its shared frontend save controller accepts the raw `
nvd.nist.gov