CVE-2026-102780: CWE-862 Missing Authorisation in joomlafry.com TF Content for Joomla

The Joomla extension TF Content versions 2.9.0 to 2.9.4 has a missing authorization vulnerability (CWE-862) in its public RecordController. The controller unconditionally authorizes creation and editing actions without verifying user permissions. The frontend save controller accepts the raw 'jform' array from requests, assigns the record ID selected by the request, and saves the record without filtering submitted properties through the configured form. Consequently, an unauthenticated guest can obtain a valid token from Joomla's public login form and modify any TF Content record, including mass assignment of critical fields such as 'published', 'access', and 'created_by'.

An unauthenticated attacker can modify any content record in the TF Content extension, including changing publication status, access permissions, and ownership metadata. This could lead to unauthorized content publication, privilege escalation, or data integrity issues within the Joomla site. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

No official patch or remediation information is provided in the advisory. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict public access to the TF Content extension or disable it if possible to prevent exploitation. Monitor for updates from the vendor regarding patches or official fixes.