CVE-2026-102779: CWE-862 Missing Authorisation in joomlafry.com TF Content for Joomla

CVE-2026-102779 describes a missing authorization (CWE-862) vulnerability in the Joomla extension TF Content versions 2.9.0 to 2.9.4. The extension exposes the 'records.custom_action' task without requiring authentication, access control lists, CSRF tokens, or any task-trigger or cron-token enforcement. As a result, an unauthenticated attacker can supply the numeric ID of any published TF Content task and cause the component to dispatch its configured executor immediately, leading to forced execution of automation tasks.

The vulnerability allows unauthenticated attackers to forcibly execute published automation tasks within the TF Content Joomla extension. This could lead to unauthorized actions being performed on the affected Joomla site. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

No official patch or vendor advisory is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected Joomla extension or disable the vulnerable functionality if possible to prevent unauthenticated task execution.