CVE-2026-77144: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 Extension "Events 2"

The TYPO3 Extension "Events 2" contains an improperly controlled modification of dynamically-determined object attributes (CWE-915). Specifically, the frontend management plugin attributes a newly created event to the submitting user's organizer record only when the request does not supply an organizer. The permission check confirms only that the user holds any organizer role, not that the user owns the organizer record. This allows a user with frontend event management access to create events attributed to another organizer, potentially leading to unauthorized event creation under different organizer identities.

An attacker with frontend event management access can create events attributed to organizers other than themselves. This could lead to unauthorized event creation and potential confusion or misuse of organizer identities within the TYPO3 system. There is no indication of privilege escalation beyond the organizer role or other impacts such as data disclosure or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links have been provided. Until a patch is available, restrict frontend event management access to trusted users only and monitor for suspicious event creation activities.