TF Content EUVD-2026-92473

Exploitation requires that the TF Content extension (versions 2.9.0-2.9.4) be installed and that at least one automation task be in 'published' state; the attacker must supply that task's numeric ID to the 'records.custom_action' site task. No authentication, ACL membership, CSRF token, task-trigger, content-binding, or cron-token is required (PR:N/UI:N), so any Guest can trigger it against a default installation. Limiting factors: the attacker can only fire tasks an administrator already created and published (not arbitrary new actions), task IDs may need enumeration or guessing, and the real impact is bounded by what each configured executor performs.

This is a genuine but mid-tier priority, not a top-of-queue emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability with no user interaction, which aligns cleanly with the CWE-862 (Missing Authorization) root cause described: a Guest can invoke the site task 'records.custom_action' with no auth, ACL, CSRF, or token enforcement. However, impact is rated Low across all three vulnerable-system metrics (VC:L/VI:L/VA:L) and there is no scope change (SC:N/SI:N/SA:N), which caps the 4.0 base score at 6.9 (Medium) - the attacker forces execution of tasks an administrator already configured and published, rather than injecting arbitrary logic. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; real-world risk is therefore driven by ease of access rather than by demonstrated attacker interest. The practical severity depends heavily on what the configured executors actually do (notifications vs. destructive data operations), which the data does not specify. Net: a real, trivially-triggerable authorization flaw worth patching promptly on affected sites, but the Low technical-impact rating and absence of KEV/EPSS/POC signals argue against treating it as a drop-everything issue.

An unauthenticated attacker browses to the vulnerable Joomla site and sends a crafted request invoking the 'records.custom_action' site task with the numeric ID of a known or guessed published TF Content task. The component dispatches that task's configured executor immediately, running the automation out-of-band without the intended trigger, cron token, or content binding. No public exploit code is identified at time of analysis, but exploitation requires only a single HTTP request and a valid published-task ID.