CVE-2026-77128 — Broken Access Control in extension "Event management and registration" (sf_event_mgt)

CVE-2026-77128

Broken Access Control in extension "Event management and registration" (sf_event_mgt) PUBLISHED

Description (CNA)

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires only that disableOverrideDemand is not enabled.

Affected (CNA)

Vendor / product	Versions
TYPO3 / Extension "Event management and registration"	affected 9.0.0 before 9.0.3; affected 8.0.0 before 8.6.2; affected 7.0.0 before 7.9.3; affected 6.0.0 before 6.7.2; affected 0 before 5.9.3

CWE

CWE-862

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-023

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.