CVE-2026-102780: Joomla TF Content Auth Bypass Vulnerability

CVE-2026-102780 Overview

CVE-2026-102780 affects the TF Content extension for Joomla, developed by joomlafry.com. Versions 2.9.0 through 2.9.4 contain a missing authorization flaw [CWE-862] in the public RecordController. The controller unconditionally authorizes both record creation and editing. Its shared frontend save controller accepts the raw jform array, assigns the request-selected existing record ID, and persists it without filtering submitted properties through the configured form. A guest can retrieve a valid token from Joomla's public login form and modify any TF Content row.

Critical Impact
Unauthenticated attackers can modify arbitrary TF Content records and mass-assign the published, access, and created_by properties.

Affected Products

Joomla Extension TF Content 2.9.0
Joomla Extension TF Content versions 2.9.1 through 2.9.3
Joomla Extension TF Content 2.9.4

Discovery Timeline

2026-10-05 - CVE-2026-102780 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-102780

Vulnerability Analysis

The TF Content extension exposes a frontend RecordController that handles both record creation and editing requests from the public site. The controller does not evaluate the caller's permissions against the targeted record. Any request that supplies a valid Joomla form token, including a token issued to a guest from the public login form, is treated as authorized.

The shared save handler reads the submitted jform array directly from the request. It then applies the record identifier chosen by the client and writes the row to the database. Because the submitted properties are not filtered through the extension's configured form definition, fields that should be protected are accepted verbatim.

The practical result is a cross-record write that lets a guest alter rows owned by other users. Attackers can tamper with content integrity, hide or expose records by toggling published, change visibility by setting access, and reassign authorship by overwriting created_by.

Root Cause

The root cause is missing authorization in the frontend save path [CWE-862] combined with an absence of allow-list filtering on the inbound jform payload. The controller trusts both the caller and the submitted field set. No per-record access check is performed before the write.

Attack Vector

Exploitation is network-based and requires no prior authentication. An attacker fetches a Joomla form token from a public endpoint such as the login form. The attacker then posts a crafted jform payload to the TF Content frontend save endpoint, specifying the target record ID and any mass-assigned fields. The server commits the modified row.

No verified public exploit code is available at this time. Technical references are published through the JoomlaFry Security Resource.

Detection Methods for CVE-2026-102780

Indicators of Compromise

Unexpected changes to the published, access, or created_by columns on TF Content tables without a corresponding administrator session in the audit log.
POST requests to the TF Content frontend save endpoint originating from unauthenticated sessions or short-lived guest cookies.
GET requests to Joomla's public login form immediately followed by frontend save requests from the same client IP within a short interval.

Detection Strategies

Correlate web server access logs for guest token issuance followed by frontend save or apply tasks against the TF Content component.
Enable database-level auditing on TF Content tables to flag updates where the pre-change created_by value differs from the post-change value.
Deploy web application firewall rules that inspect jform payloads submitted to the TF Content frontend and block requests containing restricted keys such as published, access, or created_by.

Monitoring Recommendations

Monitor Joomla application logs for authorization anomalies and for frontend edits performed under guest or newly created accounts.
Alert on bulk modifications to TF Content records within short time windows, which may indicate automated abuse.
Review backups and content revisions regularly to identify silent reassignments of record ownership.

How to Mitigate CVE-2026-102780

Immediate Actions Required

Inventory all Joomla sites running TF Content and identify instances on versions 2.9.0 through 2.9.4.
Restrict public access to the TF Content frontend save endpoints at the web server or WAF layer until a vendor patch is applied.
Audit TF Content records for unauthorized modifications to published, access, and created_by fields and restore impacted rows from backup where needed.

Patch Information

No fixed version has been published in the NVD record at the time of writing. Administrators should consult the JoomlaFry Security Resource for vendor advisories and upgrade guidance covering TF Content versions beyond 2.9.4.

Workarounds

Disable the TF Content extension on public-facing sites until a vendor fix is installed.
Block POST requests to the TF Content frontend RecordController from unauthenticated users via a reverse proxy or WAF rule.
Strip or reject jform keys for published, access, and created_by on inbound requests to the TF Content save endpoint.

bash

# Example Apache rule to block guest POSTs to the TF Content frontend save endpoint
<LocationMatch "^/index\.php">
    <If "%{QUERY_STRING} =~ /option=com_tfcontent/ && %{QUERY_STRING} =~ /task=record\.(save|apply)/">
        Require valid-user
    </If>
</LocationMatch>