CVE-2026-102779
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.
| CWE | CWE-862 |
| Vendor | joomlafry.com |
| Product | tf content for joomla |
| Published | Oct 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for joomlafry.com tf content for joomla
Be the first to know when new unknown vulnerabilities affecting joomlafry.com tf content for joomla are published โ delivered to Slack, Telegram or Discord.
Get Free Alerts โ
Free ยท No credit card ยท 60 sec setup
Affected Versions
joomlafry.com / TF Content for Joomla
2.9.0-2.9.4
Credits
ลukasz Rybak