Patch Forecast
Amber warning
Patch this week.

CVE-2026-102780

Techfry Tf Content: missing authorisation

Risk score
68/100
CVSS
9.8 v3.1
Exploit chance (30 days)
0.3%
Published
5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public RecordController. Its shared frontend save controller accepts the raw jform array, assigns the request-selected …
Affected
Techfry Tf Content
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Techfry Tf ContentTHE FLAWSTHE FIXCVE-2026-102780Missing authorisationCVSS 9.8 · EPSS 0%CVE-2026-102779Missing authorisation can leadto authentication bypassCVSS 7.3 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedTechfry Tf ContentAMBER · PATCH THIS WEEKTechfry TfContentJoomla Extension -joomlafry.com -Unauthenticated cross-recordpublication and mass assignmentin TF Content 2.9.0 - 2.9.4 - Theextension unconditionallyauthorizes both creation and…Where it standsNo known exploitationCONNECTS TOSame weaknessMissing authorisation (CWE-862)398 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Techfry Tf Content: Amber, patch this week. Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public RecordController. Its shared frontend save controller accepts the raw jform array, assigns the request-selected …

The flaws

  • CVE-2026-102780: Missing authorisation (CVSS 9.8 · EPSS 0%)
  • CVE-2026-102779: Missing authorisation can lead to authentication bypass (CVSS 7.3 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Techfry Tf Content

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 9.8 critical
  • Remotely exploitable without logging in

References

Original description

Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning `published`, `access`, and `created_by`.

Last activity 5 Oct 2026. Patch Forecast updates every hour.