TF Content for Joomla: Flaw in Versions 2.9.0 to 2.9.4

What CVE-2026-102780 is and who is affectedThe National Vulnerability Database (NVD) of NIST has published CVE-2026-102780, a security flaw in techfry...

What CVE-2026-102780 is and who is affected

The National Vulnerability Database (NVD) of NIST has published CVE-2026-102780, a security flaw in techfry tf_content, the TF Content extension for Joomla distributed by joomlafry.com. The affected range runs from version 2.9.0 (inclusive) through 2.9.4 (inclusive), as listed in the NVD entry dated 5 October 2026.

The issue is classified under CWE-862 (missing authorisation) and CWE-915 (improperly controlled modification of dynamically determined object attributes, often called mass assignment). In practice, the extension's public RecordController authorises both creation and editing without checking who is asking. Its shared frontend save controller takes the raw jform array, assigns the record ID supplied in the request and saves the result without filtering the submitted properties through the configured form. A guest can obtain a valid token from Joomla's public login form and then modify any TF Content row, including mass-assigning fields such as published, access and created_by.

NVD rates the flaw at CVSS 4.0 6.9 (MEDIUM), with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. The low complexity and the absence of required privileges or user interaction are what make it worth taking seriously, even at a medium score.

Why it matters for Joomla-based sites in Spain

This vulnerability does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalogue, and there is no public indication that it is being exploited in the wild. That is the honest reading of the available data, and it should not be overstated.

Even so, the exposure profile is uncomfortable for the kind of sites that commonly run Joomla in Catalonia and across Spain: corporate portals, municipal and association websites, catalogue sites and small e-commerce projects in Barcelona, Lleida, Tarragona and Girona. The attack surface is the public frontend, no account is needed, and the token required is one that any visitor can request from the standard login form. An attacker who can rewrite the published, access and created_by fields of arbitrary records can publish content that was never meant to be public, hide legitimate entries, or leave traces pointing at another user. On a site where content feeds newsletters, product listings or public communications, that is a reputational and operational problem before it is ever a technical one.

It is also a reminder of a broader pattern: third-party extensions are frequently the weakest link in a Joomla installation, and they are the component that site owners update least often.

What to do today

Check whether TF Content is installed. Log into the Joomla administrator panel, open the extensions list and look for techfry tf_content. If it is not installed, the flaw does not affect you.
Confirm the version. If it is present, note the exact version. Anything from 2.9.0 to 2.9.4 inclusive falls inside the affected range.
Apply the fix indicated by the vendor. The NVD entry does not state which version resolves the issue, so follow the advisory published by the developer at joomlafry.com. If no corrected release is available yet, consider disabling the extension until one is.
Look for signs of tampering. Review TF Content records for unexpected changes to publication status, access level or author, and check administrator and server logs for frontend save requests coming from unauthenticated sessions.
Reduce what is exposed. Restrict or remove public login forms where they are not needed, keep Joomla core and every extension patched, and make sure the site has tested backups that are stored off the same server.

None of these steps requires specialist tooling, but they do require someone to actually look. Extension inventories in mid-sized organisations are often out of date, and a component nobody remembers installing is exactly the one that stays unpatched.

How ALMC can help

For pymes, online shops and organisations with a small IT team, keeping this kind of exposure under control is a question of routine rather than heroics. At ALMC we run security audits and pentesting to find vulnerabilities before someone else does, harden servers and hosting environments, and monitor sites so that suspicious changes surface early instead of after a defacement or a data incident. We also handle maintenance and updates for WordPress, PrestaShop and Joomla installations, which is where most of these extension-level flaws are closed, and we clean up and repair websites that have already been compromised. If your team is two people and a hosting panel, that work is usually better placed with someone who does it every week.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.