CVE-2026-77128 Broken Access Control in extension "Event management and registration" (sf_event_mgt)
Unauthenticated users can view hidden or time-restricted events by bypassing access controls unless a specific plugin setting is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-77128?
CVE-2026-77128 is a medium-severity missing authorization vulnerability in TYPO3 Extension "Event management and registration", published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires only that disableOverrideDemand is not enabled.
Weakness: CWE-862
Which versions are affected by CVE-2026-77128?
How do I fix CVE-2026-77128?
No fix has been published for CVE-2026-77128 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-77128 being exploited?
There is no known exploitation of CVE-2026-77128 in the wild and no public exploit code.
Sources
Also known as GHSA-w95p-wfvw-xgjm.