The TYPO3 extension "Event management and registration" fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated attacker can exploit this by passing a demand-override parameter to access hidden or time-restricted events. This unauthorized access occurs unless the disableOverrideDemand plugin setting is active, which prevents the override. The vulnerability affects versions <5.9.3, =6.0.0, >=6.0.0 <6.7.2, =7.0.0, >=7.0.0 <7.9.3, =8.0.0, >=8.0.0 <8.6.2, =9.0.0, and >=9.0.0 <9.0.3 of the extension.

An unauthenticated remote user can bypass authorization controls to view events that are normally hidden or restricted by time. This could lead to unauthorized disclosure of event information. There is no indication of privilege escalation, data modification, or service disruption. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, ensure the disableOverrideDemand plugin setting is enabled to prevent exploitation of this vulnerability.