Skip to main content

TYPO3 Event Management CVE-2026-77128

| EUVDEUVD-2026-65347 MEDIUM
Missing Authorization (CWE-862)
2026-08-25 TYPO3 GHSA-w95p-wfvw-xgjm
Authentication Bypass Extension Event Management And Registration
6.3
CVSS 4.0 · Vendor: TYPO3
Share

Severity by source

Vendor (TYPO3) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable with no auth or interaction; scope unchanged; only low confidentiality impact from reading hidden event records.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TYPO3).

CVSS VectorVendor: TYPO3

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Aug 25, 2026 - 11:01 EUVD
Analysis Generated
Aug 25, 2026 - 09:48 vuln.today

DescriptionCVE.org

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires only that disableOverrideDemand is not enabled.

AnalysisAI

Unauthorized event disclosure in the TYPO3 "Event Management and Registration" extension allows unauthenticated remote users to view hidden or time-restricted events by supplying a demand-override query parameter that the extension fails to validate against its own enable-field restrictions. The vulnerability (CWE-862, Missing Authorization) is exploitable against any deployment where the disableOverrideDemand plugin setting is not explicitly activated - making non-hardened installs vulnerable by default. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify TYPO3 site with extension
Delivery
Craft URL with demand-override parameter
Exploit
Submit unauthenticated HTTP request
Execution
Extension skips enable-field check
Impact
Hidden or restricted events returned in response
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the TYPO3 installation has the 'Event Management and Registration' extension installed and that the `disableOverrideDemand` plugin setting is NOT active (either because it was never configured or because the default does not enforce it). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N) conveys a network-exploitable, low-complexity flaw with no privilege requirement, but the AT:P (attack requirements: present) metric correctly captures that exploitation depends on the `disableOverrideDemand` setting being inactive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker targeting a TYPO3 site with the Event Management and Registration extension appends the demand-override parameter to a public-facing event listing URL. Because the extension does not enforce enable-field restrictions on this parameter and `disableOverrideDemand` is inactive, the backend repository query returns records that should be hidden or not yet published, disclosing event details (titles, dates, descriptions) before their intended release. …
Remediation The primary remediation is to apply any patched extension release identified in the TYPO3 advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-023; an exact fixed version is not confirmed from the current data and should be verified there directly. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Extension Event Management And Registration

View all
CVE-2026-77129 HIGH
7.7 Aug 25

Server-Side Template Injection in TYPO3's Event Management and Registration extension allows authenticated backend edito

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-77128 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy