Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning `published`, `access`, and `created_by`.
EPSS · FIRST.org
0.29%probability of exploitation in the next 30 days
Higher than 20% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-18, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 5 oct. 2026
- Updated
- 14 oct. 2026
- Status
- Analyzed
- Source
- security@joomla.org
Affected products
Weaknesses (CWE)
References (1)
- https://www.joomlafry.com/Product
Similar CVEs
Other vulnerabilities of type CWE-862
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.