CVE-2026-102780 in TF Content Extension
Summary
by MITRE • 10/05/2026
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning `published`, `access`, and `created_by`.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in TF Content versions 2.9.0 through 2.9.4 represents a critical failure in access control logic within the Joomla CMS extension ecosystem. The core issue stems from an unauthenticated cross-record publication mechanism coupled with mass assignment flaws located in the public RecordController of the application. In standard web security practices, controllers handling sensitive data modifications must enforce strict authentication and authorization checks before processing any input that alters database records. However, this specific implementation fails to validate whether the requesting user possesses the necessary privileges for the target record or even if they are authenticated at all prior to executing save operations. This architectural oversight allows external actors to bypass standard Joomla permission layers entirely by interacting directly with the extension's API endpoints rather than through the intended administrative interface.
The technical mechanism of exploitation relies on the controller's unconditional acceptance of input data without proper sanitization or validation against configured form definitions. Specifically, the shared frontend save controller accepts a raw jform array submitted via HTTP requests and proceeds to assign values to database fields based solely on what is present in that payload. Crucially, it does not filter out properties that are intended for administrative use only, such as published status, access levels, or creator identifiers. By manipulating these specific parameters within the request body, an attacker can effectively perform mass assignment attacks where they overwrite critical metadata associated with content records. This includes the ability to change the publication state of articles from unpublished to published without approval, thereby achieving immediate public visibility for any content item managed by the extension.
Furthermore, the vulnerability enables significant operational impact regarding data integrity and user impersonation. An attacker can modify the access level of a record, potentially exposing restricted or private content to unauthorized audiences ranging from registered users to the general public depending on the specific access levels configured in Joomla. More severely, the ability to alter the created_by field allows an adversary to associate maliciously modified records with legitimate administrator accounts. This not only complicates forensic analysis and audit trails but also facilitates privilege escalation scenarios where subsequent actions taken by those compromised accounts are attributed to trusted users. The combination of unauthenticated access and unrestricted property assignment creates a high-severity risk vector that undermines the fundamental trust model of the content management system.
From an industry standards perspective, this vulnerability maps directly to CWE-284 Improper Access Control and CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes. The exploitation technique aligns with MITRE ATT&CK techniques T1078 Valid Accounts for the use of stolen or default credentials if combined with other vectors, but primarily reflects T1136 Create Account when considering the potential to create new records and T1496 Resource Hijacking if used for defacement. The lack of server-side validation on client-supplied attributes is a classic example of trusting user input without verification, which violates fundamental secure coding principles outlined in OWASP guidelines regarding broken access control and mass assignment protections.
Mitigation strategies must focus on implementing robust authorization checks within the RecordController before any save operation is executed. Developers should ensure that every modification request verifies both the authentication status of the user and their specific permission rights for the targeted record ID using Joomla's built-in ACL system. Additionally, strict input filtering must be applied to prevent mass assignment by whitelisting only the fields that are safe for public or non-administrative users to modify. The jform array should never be passed directly into database update functions without first stripping out protected attributes such as created_by, published, and access levels unless explicitly authorized by an administrator role. Upgrading to a patched version of TF Content where these controls have been re-implemented is the primary remediation step for affected installations.