EUVD-2026-65331
GHSA-4f49-557j-w78c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated frontend account required (PR:L); network-reachable endpoint (AV:N); high integrity impact from cross-organizer write; no scope change, availability impact, or meaningful confidentiality breach.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers.
AnalysisAI
Cross-organizer event modification in the TYPO3 Events 2 extension allows any authenticated frontend event manager to tamper with events owned by other organizers. The frontend management update flow performs its authorization check against a different event identifier than the one the request ultimately modifies - a textbook CWE-639 IDOR mismatch - granting write access beyond the user's legitimate scope. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active TYPO3 frontend account with event management privileges for at least one organizer (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 accurately reflects a genuine but scoped integrity threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated TYPO3 frontend user who manages their own organizer's events submits an update request to the Events 2 frontend management endpoint, substituting another organizer's event identifier in the request payload. The server's permission check evaluates the user's authorization against a different event (their own), approves the request, and writes the attacker-controlled changes to the target organizer's event record. … |
| Remediation | Consult and apply the fix documented in the TYPO3 security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-026; a patched release is indicated by the advisory's existence, but the exact version number is not confirmed in the available data and must be verified there before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all TYPO3 installations running Events 2 extension and document the deployed version and number of active organizers; disable frontend event modification permissions for non-essential users and restrict access to administrative accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Extension Events 2
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today