High severity · published Aug 25, 2026
CVE-2026-77144
Broken Access Control in extension "Events 2" (events2)
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event management access could therefore create an event that is attributed to another organizer.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EE
Extension "Events 2" · TYPO3
10.0.0 before 10.2.12; 9.0.0 before 9.4.2; before 8.6.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77144
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77144
typo3.org
https://typo3.org/security/advisory/typo3-ext-sa-2026-026
More from Extension "Events 2"
7.1
CVE-2026-77145
Broken Access Control in extension "Events 2" (events2)