CVE-2026-102779

Name of the Vulnerable Software and Affected Versions TF Content versions 2.9.0 through 2.9.4

Description The extension exposes the site task records.custom action without authentication, Access Control List (ACL), Cross-Site Request Forgery (CSRF) protection, task-trigger, content-binding, or cron-token enforcement. This allows an unauthenticated guest to provide the numeric ID of any published TF Content task and force the component to execute its configured executor immediately.

Recommendations Update TF Content to a version later than 2.9.4.