CVE-2026-77145: 
PHP vulnerability analysis and mitigation

CVE-2026-77145 is an authorization bypass vulnerability in the TYPO3 extension "Events 2" (jweiland/events2) that allows authenticated users with frontend event management access to modify events belonging to other organizers. The flaw stems from a flawed permission check in the frontend management update flow, which validates a different event than the one ultimately modified. Affected versions are 10.0.0 through 10.2.11 (fixed in 10.2.12). It was published on August 25, 2026, with a CVSS v4.0 base score of 7.1 (High), assigned by TYPO3 (GitHub Advisory, TYPO3 Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key): the system's authorization logic checks permissions against one event record but then applies the update operation to a different, attacker-specified event record. This is a classic IDOR (Insecure Direct Object Reference) pattern where a user-controlled key (the event identifier in the update request) is not re-validated against the authenticated user's permissions before the modification is committed. Exploitation requires only low-level privileges (a valid frontend event management account) and no user interaction, making it straightforward to execute over the network (GitHub Advisory, TYPO3 Advisory).

Successful exploitation allows any authenticated frontend event manager to overwrite or tamper with event records owned by other organizers, resulting in a high integrity impact on the vulnerable system. Confidentiality impact is rated low, as some event data may be readable during the manipulation process. Availability is not directly affected, and there is no impact on subsequent systems. The primary risk is unauthorized modification of event content across the platform, which could disrupt event listings, spread misinformation, or undermine trust in the platform's data integrity (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term (EUVD). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

1. Obtain a frontend account: Register or obtain credentials for a TYPO3 frontend account that has been granted event management access on the target site running jweiland/events2 versions 10.0.0–10.2.11.
2. Identify target event: Browse the frontend event management interface or enumerate event IDs belonging to other organizers (e.g., by observing event URLs or API responses that expose event identifiers).
3. Craft a malicious update request: Intercept a legitimate event update request (e.g., using a proxy tool like Burp Suite) and replace the event identifier in the request payload with the ID of an event owned by a different organizer.
4. Submit the modified request: Send the crafted HTTP request to the frontend management update endpoint. The permission check validates the original (attacker-owned) event, but the update is applied to the target event.
5. Confirm unauthorized modification: Verify that the target event's data has been altered, confirming successful authorization bypass (TYPO3 Advisory, GitHub Advisory).

• Logs: TYPO3 frontend request logs showing update requests to the event management endpoint where the event ID in the request body differs from the event ID associated with the authenticated user's organizer account.
• Application Data: Unexpected changes to event records (title, description, date, location, etc.) for events not owned by the logged-in frontend user, particularly if the modification timestamp does not align with the legitimate organizer's activity.
• Network: Repeated HTTP POST/PUT requests to the frontend event update endpoint from a single authenticated session, targeting multiple different event IDs in rapid succession.

Upgrade the jweiland/events2 TYPO3 extension to version 10.2.12 or later, which corrects the permission check to validate the same event that will be modified (TYPO3 Advisory). As a temporary workaround until patching is possible, restrict frontend event management access to only fully trusted users and audit event modification logs for unauthorized changes. No configuration-only mitigation is available that fully addresses the flaw.