Vulnerability · Published Aug 25, 2026 · Assigned by TYPO3

CVE-2026-77128Broken Access Control in extension "Event management and registration" (sf_event_mgt)

Medium 6.3

In plain English

A medium-severity missing authorization in Extension "Event management and registration" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.5%top 56.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires only that disableOverrideDemand is not enabled.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	Extension "Event management and registration"	9.0.0 – before 9.0.38.0.0 – before 8.6.27.0.0 – before 7.9.36.0.0 – before 6.7.20 – before 5.9.3

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-023 vendor-advisory