CVE-2026-102779: Joomla TF Content Auth Bypass Vulnerability

CVE-2026-102779 Overview

CVE-2026-102779 is a missing authorization vulnerability [CWE-862] in the JoomlaFry TF Content extension for Joomla, affecting versions 2.9.0 through 2.9.4. The extension exposes the site task records.custom_action without authentication, access control list (ACL) checks, cross-site request forgery (CSRF) protection, task-trigger validation, content binding, or cron-token enforcement. An unauthenticated Guest user can supply the numeric ID of any published TF Content task and force the component to dispatch its configured executor immediately.

Critical Impact
Remote, unauthenticated attackers can trigger execution of any published automation task on a vulnerable Joomla site, bypassing all intended access controls.

Affected Products

JoomlaFry TF Content 2.9.0
JoomlaFry TF Content versions 2.9.1 through 2.9.3
JoomlaFry TF Content 2.9.4

Discovery Timeline

2026-10-05 - CVE-2026-102779 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-102779

Vulnerability Analysis

The TF Content extension registers a site-facing task named records.custom_action within the Joomla component dispatcher. This task is reachable through the standard index.php?option=com_tfcontent&task=records.custom_action endpoint. The handler accepts a numeric task ID and invokes the executor configured for that automation record.

The handler performs no identity or permission verification before dispatching the executor. A Guest session is sufficient to invoke the method, and the component does not validate that the request originated from the Joomla scheduler, an authenticated administrator, or a trusted cron token. This allows arbitrary enumeration and invocation of any published automation task registered in the component.

Because automation tasks in TF Content can be bound to arbitrary executors defined by the site operator, the real-world impact depends on what each configured task does. Common effects include mass content changes, outbound notifications, database writes, or integration callbacks executed outside their intended trigger window.

Root Cause

The root cause is missing authorization [CWE-862] on a publicly reachable site task. The records.custom_action method lacks any combination of session validation, ACL enforcement, CSRF token verification, task-trigger context checks, content-binding validation, or cron-token comparison. Any one of these controls would normally gate automation dispatch.

Attack Vector

Exploitation requires only network access to the vulnerable Joomla site. An attacker enumerates numeric task IDs and issues an HTTP GET or POST to the com_tfcontent component with task=records.custom_action and the target ID as a parameter. The component resolves the record, locates its configured executor, and runs it with the privileges of the component itself. No authentication, user interaction, or prior reconnaissance beyond ID enumeration is required.

The vulnerability description from the vendor does not include a published proof-of-concept. Technical details are referenced on the JoomlaFry Blog.

Detection Methods for CVE-2026-102779

Indicators of Compromise

Web server access log entries containing option=com_tfcontent combined with task=records.custom_action originating from unauthenticated sessions or unexpected IP ranges.
Automation task executions in TF Content audit logs occurring outside the configured cron schedule or without a corresponding administrator session.
Unexpected content modifications, outbound notifications, or integration callbacks produced by TF Content tasks at anomalous times.

Detection Strategies

Monitor Joomla access logs for repeated requests to records.custom_action with incrementing numeric ID parameters, which indicate task ID enumeration.
Correlate TF Content executor runs with authenticated administrator sessions and scheduled cron windows; flag any run that lacks both.
Alert on HTTP requests to com_tfcontent endpoints that carry no valid Joomla session cookie or CSRF token.

Monitoring Recommendations

Enable verbose logging on the Joomla application and forward web server logs to a centralized analytics platform for retention and query.
Baseline the normal execution frequency of each TF Content automation task and alert on deviations.
Track outbound network connections initiated by the Joomla PHP worker processes to detect unauthorized executor behavior.

How to Mitigate CVE-2026-102779

Immediate Actions Required

Identify all Joomla installations running TF Content versions 2.9.0 through 2.9.4 and prioritize them for remediation.
Temporarily unpublish non-essential TF Content automation tasks to reduce the attack surface until a patched release is applied.
Restrict access to the com_tfcontent component at the web server or WAF layer to trusted administrative IP ranges.

Patch Information

Consult the JoomlaFry Blog for the current fixed release of TF Content and vendor remediation guidance. Upgrade to the vendor-supplied patched version as soon as it is available and validate that the records.custom_action task enforces authentication, ACL, and CSRF protections after the update.

Workarounds

Block unauthenticated HTTP requests that match option=com_tfcontent&task=records.custom_action using a web application firewall rule.
Require authenticated administrator sessions for all com_tfcontent routes by applying .htaccess or reverse-proxy access controls.
Disable the TF Content extension entirely if automation tasks are not in active use until the vendor patch is deployed.

bash

# Example Apache rule to block unauthenticated access to the vulnerable task
<LocationMatch "/index\.php">
    SetEnvIfNoCase Query_String "option=com_tfcontent.*task=records\.custom_action" BLOCK_TFCONTENT
    Require all granted
    Require not env BLOCK_TFCONTENT
</LocationMatch>