Frontend Event Management Vulnerability in TYPO3 by TYPO3 Association
CVE-2026-77145

7.1HIGH

Key Information:

Vendor

Typo3

Status
Extension "events 2"
Vendor
CVE Published:
25 August 2026

What is CVE-2026-77145?

An access control flaw in the frontend management update flow of TYPO3 allows users with event management access to alter events that belong to other organizers. This weakness arises because the permission checks verify a different event than the one being modified, potentially leading to unauthorized changes and impacting the integrity of event data. Users are encouraged to review the latest security advisories and implement appropriate updates to safeguard against this vulnerability.

Affected Version(s)

Extension "Events 2" 10.0.0 < 10.2.12

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-026
vendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Seungbin Yang
Hoja Mustaffa Abdul Latheef
.