Vulnerability · Published Aug 25, 2026 · Assigned by TYPO3

CVE-2026-77144Broken Access Control in extension "Events 2" (events2)

High 7.1

In plain English

A high-severity security flaw in Extension "Events 2" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.4%top 64.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event management access could therefore create an event that is attributed to another organizer.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	Extension "Events 2"	10.0.0 – before 10.2.129.0.0 – before 9.4.20 – before 8.6.3

Weakness: CWE-915 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-026 vendor-advisory