Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-102779

Techfry Tf Content: missing authorisation can lead to authentication bypass

Risk score
52/100
CVSS
7.3 v3.1
Exploit chance (30 days)
0.3%
Published
5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task records.custom_action without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any…
Affected
Techfry Tf Content
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Techfry Tf ContentTHE FLAWSTHE FIXCVE-2026-102779Missing authorisation can leadto authentication bypassCVSS 7.3 · EPSS 0%CVE-2026-102780Missing authorisationCVSS 9.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedTechfry Tf ContentAMBER · PATCH THIS WEEKTechfry TfContentJoomla Extension -joomlafry.com -Unauthenticated cross-recordpublication and mass assignmentin TF Content 2.9.0 - 2.9.4 - Theextension unconditionallyauthorizes both creation and…Where it standsNo known exploitationCONNECTS TOSame weaknessMissing authorisation (CWE-862)398 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Techfry Tf Content: Amber, patch this week. Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public RecordController. Its shared frontend save controller accepts the raw jform array, assigns the request-selected …

The flaws

  • CVE-2026-102779: Missing authorisation can lead to authentication bypass (CVSS 7.3 · EPSS 0%)
  • CVE-2026-102780: Missing authorisation (CVSS 9.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Techfry Tf Content

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.3 high
  • Remotely exploitable without logging in

References

Original description

Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.

Last activity 5 Oct 2026. Patch Forecast updates every hour.