CVE-2026-77144
Received Received - Intake

Frontend Event Management Plugin Organizer Attribution Bypass

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: TYPO3

Description
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event management access could therefore create an event that is attributed to another organizer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-77144
EUVD
EUVD-2026-65332

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
typo3 events2 to 10.2.11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Broken Access Control issue in the Events 2 extension for TYPO3. It allows users with frontend event management access to create events that are incorrectly attributed to another organizer. The problem occurs because the system only assigns the event to the submitting user's organizer record if no organizer is specified in the request, and the permission check does not properly verify the organizer ownership.

Detection Guidance

Check if the Events 2 extension version is 10.2.11 or below. Use commands like 'composer show typo3/cms-events2' or inspect the extension manager in TYPO3 backend to verify the installed version.

Impact Analysis

This vulnerability could allow unauthorized users to create or manipulate events under another organizer's name. This could lead to misattribution of events, potential reputational damage, or confusion in event management. Users with malicious intent might exploit this to frame other organizers or disrupt event coordination.

Compliance Impact

This vulnerability could potentially impact compliance with data protection regulations like GDPR and HIPAA by allowing unauthorized users to manipulate event attribution, which may lead to improper data handling or access controls. The broken access control flaw enables users to create or modify events attributed to other organizers, potentially violating integrity and accountability requirements.

Mitigation Strategies

Update the Events 2 extension to version 10.2.12 immediately via the TYPO3 extension manager, Packagist, or the official TYPO3 extensions repository.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart