CVE-2026-102779 in TF Content Extension
Summary
by MITRE • 10/05/2026
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in Joomla extensions distributed via joomlafry.com, specifically affecting versions 2.9.0 through 2.9.4 of the TF Content component, represents a critical failure in access control logic that allows for unauthenticated forced execution of automation tasks. This flaw stems from an incomplete implementation of security boundaries within the extension's task dispatching mechanism. The core issue lies in the exposure of the internal site task records.custom_action without any requisite authentication checks or authorization validations. In standard Joomla architecture, administrative actions and automated processes are typically protected by Access Control Lists (ACL) to ensure that only users with specific roles can trigger such operations. However, this extension fails to enforce these controls on the endpoint responsible for executing custom automation tasks, thereby allowing any visitor, including unauthenticated guests, to interact directly with backend logic intended for privileged users or system processes.
From a technical perspective, the vulnerability exploits the lack of input validation and state verification in the task execution flow. The component accepts a numeric identifier representing a published TF Content task ID from user-supplied parameters without verifying if the requester has permission to execute that specific task. Furthermore, there is no enforcement of Cross-Site Request Forgery (CSRF) tokens, which are essential for preventing unauthorized commands from being transmitted from a site where the victim user is authenticated. The absence of a content-binding mechanism means the action is not tied securely to a specific context or session state, and the lack of cron-token enforcement removes any additional layer of validation that might restrict execution to scheduled intervals or authorized triggers. Consequently, an attacker can craft a simple HTTP request containing the ID of any published task, causing the server to immediately dispatch its configured executor with full privileges associated with the component's backend operations.
The operational impact of this vulnerability is severe due to the nature of automation tasks within content management systems. These tasks often perform sensitive actions such as database modifications, file system changes, email notifications, or integrations with external services. An unauthenticated attacker can leverage this flaw to execute arbitrary code logic defined by the task configuration, potentially leading to remote code execution if the executor invokes unsafe functions. Even without direct code execution, the ability to force-trigger tasks allows for denial of service through resource exhaustion, data integrity violations via unauthorized database updates, and privacy breaches if tasks involve sending sensitive information or scraping private content. This effectively bypasses all intended security controls, turning a feature designed for administrative efficiency into an attack vector that compromises the entire Joomla instance's confidentiality, integrity, and availability.
This vulnerability aligns with CWE-284 Improper Access Control, as it involves unauthorized access to functionality due to insufficient restrictions on authenticated users or unauthenticated actors. It also maps closely to ATT&CK technique T1059 Command and Scripting Interpreter if the executed tasks involve running scripts, or more broadly to privilege escalation vectors where low-privilege entities gain high-level capabilities. To mitigate this risk, immediate action is required by updating the TF Content extension to a patched version that enforces strict authentication checks on all task execution endpoints. Developers must implement robust ACL verification for every administrative and automated function, ensuring that only users with explicit permissions can trigger records.custom_action. Additionally, integrating CSRF token validation into form submissions and API calls will prevent forced browsing attacks. Implementing rate limiting and input sanitization further hardens the application against abuse of automation features. Until patches are applied, administrators should consider disabling the affected component or restricting access to the Joomla backend via IP whitelisting as a temporary countermeasure.