Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

Events 2 plugin lets user assign events to other organizers

CVE-2026-77144 · published 2 months ago
Summary

The Events 2 extension for managing events on a website does not correctly verify who should own a newly created event. A staff member with permission to add events could accidentally or deliberately create an event that appears to belong to a different organizer. Check the extension for an update or restrict who can add events until the issue is fixed.

What to do
  • Update typo3 extension "events 2" to version 10.2.12 or later.
Affected software
VendorProductAffected versions
typo3 extension "events 2" < 10.2.12
Original advisory text
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check c...
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event management access could therefore create an event that is attributed to another organizer.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes
Timeline
Published25 Aug 2026
Updated4 Nov 2026
First seen25 Aug 2026
Sources
CVE-2026-77144 · NVD
CVE-2026-77144 · MITRE
Track software like this
Free during beta