Medium severityNVD Advisory· Published Oct 5, 2026
CVE-2026-102779
CVE-2026-102779
Description
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task records.custom_action without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: 2.9.0 - 2.9.4
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.