TYPO3 Frontend Event Plugin Enables Privilege Escalation Organizer Attribution
CVE-2026-77144 Published on August 25, 2026

Broken Access Control in extension "Events 2" (events2)
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event management access could therefore create an event that is attributed to another organizer.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-77144 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE

Weakness Type

What is a Mass Assignment Vulnerability?

The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

CVE-2026-77144 has been classified to as a Mass Assignment vulnerability or weakness.


Affected Versions

TYPO3 Extension "Events 2":