Frontend Event Management Vulnerability in TYPO3 by TYPO3
CVE-2026-77144

7.1HIGH

Key Information:

Vendor

Typo3

Status
Extension "events 2"
Vendor
CVE Published:
25 August 2026

What is CVE-2026-77144?

The TYPO3 Frontend Management Plugin has a flaw where events created by a user are attributed to another user's organizer account if the submitted request lacks its own organizer information. This occurs due to inadequate permission checks, which only verify if the submitting user has any organizer role. This design oversight allows malicious users with frontend event management access to create events that appear linked to legitimate organizers, potentially leading to confusion and unauthorized event representation.

Affected Version(s)

Extension "Events 2" 10.0.0 < 10.2.12

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-026
vendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Seungbin Yang
Hoja Mustaffa Abdul Latheef
.