CVE-2026-77144: 
PHP vulnerability analysis and mitigation

CVE-2026-77144 is an authorization bypass vulnerability in the TYPO3 "Events 2" extension (jweiland/events2) that allows authenticated users with frontend event management access to attribute newly created events to arbitrary organizers without proper authorization. The flaw was disclosed on August 25, 2026, and affects versions 10.0.0 through 10.2.11 (fixed in 10.2.12). It carries a CVSS v4.0 base score of 7.1 (High), assigned by TYPO3 (GitHub Advisory, TYPO3 Advisory).

The root cause is classified as CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). When a user submits an event creation request via the frontend management plugin, the system assigns the event to the submitting user's own organizer record only if no organizer is specified in the request. However, the permission check only verifies that the submitting user holds any organizer role — it does not validate whether the user is authorized to attribute events to a specific organizer. This means a malicious user can craft a request that explicitly specifies another organizer's record, bypassing the intended access control (GitHub Advisory, TYPO3 Advisory).

A successfully exploited vulnerability allows any authenticated user with frontend event management access to fraudulently create events attributed to other organizers, undermining the integrity of event data within the TYPO3 CMS instance. The primary impact is on data integrity (rated High in CVSS v4.0), with a low confidentiality impact due to potential exposure of organizer-related information. Availability is not affected, and there is no known lateral movement potential beyond the Events 2 extension's data scope (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires low privileges (an authenticated organizer role) and no user interaction, making it accessible to any user who has been granted frontend event management access (GitHub Advisory, TYPO3 Advisory).

1. Obtain access: Authenticate to the TYPO3 frontend with an account that holds any organizer role and has frontend event management access.
2. Enumerate organizers: Identify the IDs or identifiers of other organizer records within the system (e.g., by browsing the frontend event management interface or inspecting form fields).
3. Craft malicious request: Submit an event creation request via the frontend management plugin, explicitly including a target organizer's identifier in the request body (e.g., as a form field or POST parameter) rather than omitting it.
4. Bypass permission check: The plugin's permission check confirms only that the submitting user holds an organizer role, without validating ownership of the specified organizer record, so the request is accepted.
5. Event attributed to victim organizer: The newly created event is saved in the database attributed to the targeted organizer, not the submitting user (TYPO3 Advisory, GitHub Advisory).

• Logs: TYPO3 frontend request logs showing event creation POST requests where the organizer field value does not match the authenticated user's own organizer record.
• Database: Events in the tx_events2_domain_model_event table where the organizer field references an organizer not associated with the creating frontend user account.
• Application Logs: Repeated event creation submissions from a single user account targeting multiple different organizer IDs in a short time window.

Update the jweiland/events2 TYPO3 extension to version 10.2.12 or later, which contains the security fix released on August 25, 2026. As an interim workaround, restrict frontend event management access to only fully trusted users until the patch is applied. Additionally, review existing event records to identify any unauthorized organizer attributions that may have occurred prior to patching (TYPO3 Advisory, GitHub Advisory).