CVE-2026-102780 is a critical (CVSS 9.8) flaw in TF Content for Joomla, versions 2.9.0 through 2.9.4. The public controller allows guests to create and edit records and accepts raw submitted fields, so a guest can change any row, including published and access settings. The record names no fix, so check the vendor.
What's affected
The record covers TF Content 2.9.0 through 2.9.4. It names no fixed release and links only to the vendor's home page. Check the vendor for a newer version, and read its notes before trusting it.
The extension's public RecordController unconditionally authorizes both creating and editing. The shared save controller then takes the raw jform array, uses the request-selected record ID, and saves without filtering the fields through the form definition.
How to check if you're exposed
This is a Joomla extension, so check inside Joomla.
- In the administrator area, open System, then Manage, then Extensions, and search for TF Content.
- Read the installed version. The record covers TF Content 2.9.0 through 2.9.4.
- Check the files on the server too, since a site can carry a copy of an extension that is disabled but still reachable. Look for the extension's directory under
components.
If you manage many sites, list installed extensions across all of them and compare against this record.
What to do now
- Check the vendor site for a release newer than 2.9.4 and apply it.
- If no fixed release exists, disable or uninstall TF Content, or remove public access to its records.
- Review content records for unexpected changes, in particular the published, access and created by fields.
- Check your web server and application logs for unusual requests to the extension's pages since the record was published. A log review proves nothing in either direction by itself, but it can show you what to look at next.
- Rescan your inventory afterwards to confirm the vulnerable version is gone from every site.
Why it matters
Two problems stack up. The first is missing authorization, filed as CWE-862: the controller says yes to every create and edit. The second is mass assignment, filed as CWE-915: the code saves whatever fields the request supplies instead of the fields the form allows.
The record says a guest can obtain a valid token from Joomla's public login form and change any row. Changing the published and access fields lets an attacker publish content or alter who can see it, and rewriting the created by field changes who owns it.
The fix pattern is to check permissions per record and to copy only a named list of fields from the request. The record does not report exploitation in the wild, and the KEV flag is false.
Quick check
What is mass assignment?
It is when code copies all the fields in a request onto a stored object, including ones the user should never control. The fix is a short list of the fields a user may set.
Sources
Last reviewed: 19 October 2026.
