TYPO3 Event Management CVE-2026-77128

Exploitation requires that the TYPO3 installation has the 'Event Management and Registration' extension installed and that the disableOverrideDemand plugin setting is NOT active (either because it was never configured or because the default does not enforce it). No authentication is required (CVSS PR:N), no user interaction is needed, and access is over the network. Exploitation is limited to reading hidden or time-restricted event records only - it does not grant write access, administrative access, or access to non-event data. The presence of disableOverrideDemand in an active state fully prevents exploitation.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N) conveys a network-exploitable, low-complexity flaw with no privilege requirement, but the AT:P (attack requirements: present) metric correctly captures that exploitation depends on the disableOverrideDemand setting being inactive. Impact is narrowly scoped: only confidentiality of hidden or time-restricted event records is at risk - there is no integrity or availability dimension confirmed. The vulnerability is not listed in CISA KEV and no POC has been disclosed, keeping real-world urgency moderate despite the zero-authentication requirement. EPSS data is unavailable in the provided intelligence; given the niche product footprint and the opt-in mitigation that many hardened sites may already have active, actual exploitation probability is likely below what the raw CVSS score implies. The absence of version-range data in the CPE string means the full scope of exposure cannot be precisely bounded from available data alone.

An unauthenticated attacker targeting a TYPO3 site with the Event Management and Registration extension appends the demand-override parameter to a public-facing event listing URL. Because the extension does not enforce enable-field restrictions on this parameter and disableOverrideDemand is inactive, the backend repository query returns records that should be hidden or not yet published, disclosing event details (titles, dates, descriptions) before their intended release. No authenticated session or prior reconnaissance beyond knowing the extension is installed is required.