Medium severity · published Aug 25, 2026
CVE-2026-77128
Broken Access Control in extension "Event management and registration" (sf_event_mgt)
6.3
CVSS
0.5%
EPSS
No
On KEV
Description
The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires only that disableOverrideDemand is not enabled.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EE
Extension "Event management and registration" · TYPO3
9.0.0 before 9.0.3; 8.0.0 before 8.6.2; 7.0.0 before 7.9.3; 6.0.0 before 6.7.2; before 5.9.3 · source: vendor
Affected product
EE
Extension "Event management and registration"
TYPO3
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77128
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77128
typo3.org
https://typo3.org/security/advisory/typo3-ext-sa-2026-023
More from Extension "Event management and registration"
7.7
CVE-2026-77129
Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt)