EUVD-2026-65332
GHSA-fc27-9m9g-625p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network exploitation requires low-privilege organizer authentication (PR:L); integrity impact is high via unauthorized attribution, with low incidental confidentiality exposure.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event management access could therefore create an event that is attributed to another organizer.
AnalysisAI
Unauthorized organizer attribution in the TYPO3 Events 2 frontend management extension allows any authenticated organizer-role user to create events falsely attributed to another organizer's record by supplying a foreign organizer identifier in the event creation request. The flaw stems from a permission check that validates only the presence of any organizer role rather than verifying the submitting user's ownership of the specific organizer referenced in the request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a TYPO3 installation with the Events 2 extension installed and the frontend event management feature enabled; default TYPO3 installations without this extension are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N) confirms a network-accessible attack with no special conditions, requiring only low privilege, yielding a 7.1 base score primarily driven by high vulnerable-system integrity impact (VI:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated TYPO3 frontend user holding any valid organizer role crafts an event creation POST request that specifies a different organizer's record identifier in the organizer field rather than their own. Because the server-side permission check validates only that the submitting user holds some organizer role - not that they own the specified organizer record - the event is created and publicly attributed to the victim organizer without their knowledge or consent. … |
| Remediation | Apply the patched release of the Events 2 extension as directed by TYPO3 security advisory typo3-ext-sa-2026-026, available at https://typo3.org/security/advisory/typo3-ext-sa-2026-026; the exact fixed version number is not independently confirmable from the available data beyond the vendor advisory reference, so administrators should consult that advisory directly for the target upgrade version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all systems running TYPO3 Events 2, identify and enumerate all active organizer-role accounts, review event creation logs from the past 90 days for anomalous cross-organizer attribution patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Extension Events 2
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today