CVE-2026-102779 is a High (CVSS 7.3) missing authorization flaw in TF Content for Joomla, versions 2.9.0 through 2.9.4. The records.custom_action task has no authentication, so a guest can make the component run any published automation task. Update when a fix is available.
What's affected
The weakness is CWE-862 (missing authorization). The record says TF Content versions 2.9.0 through 2.9.4 are affected.
The description is that the extension exposes the site task records.custom_action without authentication, access control lists, CSRF protection, task trigger checks, content binding or cron token checks. A guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.
What that means in practice depends on what your tasks do. TF Content tasks are automations that run against content. If a task sends email, changes articles or calls an outside service, a guest can trigger it on demand, and repeatedly. The vector is network, low complexity, no privileges, no user interaction, with low impact on confidentiality, integrity and availability.
The only reference in the record is the vendor's website. We did not find a vendor advisory or a confirmed fixed version, so check the extension's download page and changelog for a release later than 2.9.4.
How to check if you're exposed
In the Joomla administrator, open System, Manage, Extensions and search for TF Content to read the version. If it is between 2.9.0 and 2.9.4, you are in range.
Then list the published tasks in the extension and read what each one does. Tasks that send messages, modify content or call external services deserve the closest attention. Tasks that are unpublished are not reachable by this route, according to the record, since it says published tasks.
Review the web server logs for requests that call the custom action task from visitors with no session, in particular repeated requests with changing numeric IDs.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Look for a TF Content release after 2.9.4 on the vendor site and update.
- Unpublish tasks you do not need, since the record says published tasks are the ones a guest can run.
- Review what each remaining task does and disable any that sends mail or changes content until you have updated.
- Block or rate limit the affected task at the web server or a web application firewall for unauthenticated requests.
- Check logs and task output for runs you did not schedule.
Why it matters
Missing authorization means the server never asks who is calling. Automation endpoints are especially risky because they were built to be triggered by a scheduler, and nothing stops a visitor from acting as the scheduler. The record lists the missing cron token as one of the absent checks.
The score is High rather than Critical because the record rates each impact as low. The real impact is set by the tasks you configured. The record does not mark the CVE as known exploited.
Quick check
Can a guest run an unpublished task?
The record says a guest can run any published task. It does not say unpublished tasks are reachable.
Is there a patched version?
We could not confirm one. Check the vendor site for a release after 2.9.4.
Sources
Last reviewed: 18 October 2026.
