Extension Events 2
Monthly
Unauthorized organizer attribution in the TYPO3 Events 2 frontend management extension allows any authenticated organizer-role user to create events falsely attributed to another organizer's record by supplying a foreign organizer identifier in the event creation request. The flaw stems from a permission check that validates only the presence of any organizer role rather than verifying the submitting user's ownership of the specific organizer referenced in the request. No public exploit has been identified and this vulnerability is absent from CISA KEV; however, the CVSS 4.0 score of 7.1 reflects a high integrity impact on the vulnerable system driven by straightforward, low-privilege network exploitation with no additional attack requirements.
Cross-organizer event modification in the TYPO3 Events 2 extension allows any authenticated frontend event manager to tamper with events owned by other organizers. The frontend management update flow performs its authorization check against a different event identifier than the one the request ultimately modifies - a textbook CWE-639 IDOR mismatch - granting write access beyond the user's legitimate scope. No public exploit has been identified at time of analysis, but with a CVSS 4.0 score of 7.1 (VI:H) and only low-privilege authentication required (PR:L), the integrity risk is meaningful in any multi-organizer TYPO3 deployment.
Unauthorized organizer attribution in the TYPO3 Events 2 frontend management extension allows any authenticated organizer-role user to create events falsely attributed to another organizer's record by supplying a foreign organizer identifier in the event creation request. The flaw stems from a permission check that validates only the presence of any organizer role rather than verifying the submitting user's ownership of the specific organizer referenced in the request. No public exploit has been identified and this vulnerability is absent from CISA KEV; however, the CVSS 4.0 score of 7.1 reflects a high integrity impact on the vulnerable system driven by straightforward, low-privilege network exploitation with no additional attack requirements.
Cross-organizer event modification in the TYPO3 Events 2 extension allows any authenticated frontend event manager to tamper with events owned by other organizers. The frontend management update flow performs its authorization check against a different event identifier than the one the request ultimately modifies - a textbook CWE-639 IDOR mismatch - granting write access beyond the user's legitimate scope. No public exploit has been identified at time of analysis, but with a CVSS 4.0 score of 7.1 (VI:H) and only low-privilege authentication required (PR:L), the integrity risk is meaningful in any multi-organizer TYPO3 deployment.