Vulnerability Details CVE-2026-102779
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 16.4%
CVSS Severity
CVSS v3 Score 7.3
References
Products affected by CVE-2026-102779
-
cpe:2.3:a:techfry:tf_content:*