TYPO3 Event Registration CVE-2026-77129

Exploitation requires a valid TYPO3 backend account with edit access specifically to the event registration plugin or backend module - this is the explicit prerequisite stated in the CVE description. Anonymous or unauthenticated access is insufficient. The attack is further limited to TYPO3 installations that have deployed the Event Management and Registration extension and have provisioned backend editor roles with access to that plugin. Default TYPO3 installations without this extension are not affected. What limits exploitation: the required backend authentication and specific plugin permission make this a trusted-insider or post-credential-compromise vector, not an internet-facing mass-exploitation risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H) signals high potential impact but with two meaningful dampeners: AT:P (attack precondition - authenticated backend access with specific plugin edit rights) and PR:L (low privilege, but still requires a valid TYPO3 backend account). In practice, the threat actor is a malicious or compromised backend editor, not an anonymous internet attacker. This is a significant insider-threat or post-compromise escalation vector rather than an external mass-exploitation risk. No EPSS data is provided. No KEV listing and no POC are identified, further reducing urgency for most deployments. For agencies or SaaS platforms that provision TYPO3 backend accounts to untrusted clients or editors, however, this is a real containment failure: an editor can reach beyond their intended privilege boundary to read system data or manipulate TypoScript rendering.

A backend editor account - legitimately provisioned or compromised via credential theft - logs into the TYPO3 backend and navigates to the event registration plugin configuration. The attacker enters a crafted Fluid ViewHelper expression (e.g., referencing internal object properties or invoking a TypoScript content object) into the email subject field. When the extension renders a registration confirmation email using this field, the Fluid engine evaluates the injected syntax server-side, returning sensitive application data in the rendered output or executing arbitrary TypoScript logic.