Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-77128

Broken Access Control in extension "Event management and registration" (sf_event_mgt)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TYPO3

Description

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires only that disableOverrideDemand is not enabled.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TYPO3 Extension "Event management and registration"

Default version status: unaffected

  • 9.0.0 to < 9.0.3affected
  • 8.0.0 to < 8.6.2affected
  • 7.0.0 to < 7.9.3affected
  • 6.0.0 to < 6.7.2affected
  • 0 to < 5.9.3affected

References