TF Content for Joomla EUVD-2026-92452

Exploitation requires that the vulnerable TF Content extension (versions 2.9.0 through 2.9.4) be installed on a reachable Joomla site with its public frontend record save path (RecordController) accessible - the default behavior for the extension's frontend. The attacker needs only a valid Joomla token obtainable from the public login form (no account, no privileges, no user interaction), and the request must supply an existing TF Content record ID plus the target jform fields. Limiting factors: the target must actually have TF Content 2.9.0-2.9.4 deployed with frontend record functionality enabled; impact is bounded to TF Content rows and the manipulable fields (published, access, created_by) rather than full site compromise.

This is a genuine but moderate-priority issue rather than a critical emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, low-complexity exploitation with no privileges and no user interaction - a Guest simply harvests a valid CSRF token from Joomla's public login form, so the missing authorization (CWE-862) is trivially reachable. However, the impact metrics are all Low (VC:L/VI:L/VA:L) and the base score is 6.9 (Medium), reflecting that the flaw grants record manipulation/mass assignment rather than full code execution or total data compromise. There is no EPSS score, no CISA KEV listing, and no POC referenced in the provided data - so exploitation is assessed as no public exploit identified at time of analysis, and the real-world probability signal is absent. The dominant real-world risk is content integrity and limited confidentiality: mass-assigning published, access, and created_by lets an attacker expose draft/restricted records, deface or inject content, or reassign ownership. Note one tagging mismatch to verify: the input Tag labels this 'Authentication Bypass,' but the description and CWE-862 describe a missing-authorization / broken-access-control flaw on an authenticated-equivalent path (the attacker holds a legitimately issued Guest token), not a bypass of the authentication mechanism itself.

An unauthenticated attacker visits the target Joomla site, requests the public login page to obtain a valid session token, then submits a crafted POST to the TF Content public RecordController's save endpoint with a jform array containing an existing record ID plus published, access, and created_by values. Because the controller unconditionally authorizes editing and never filters the submitted properties through the configured form, the attacker overwrites or publishes arbitrary TF Content rows. No public exploit code is identified at time of analysis, but the attack is low-complexity and requires no authentication.