The vulnerability arises from improper control of dynamically-determined object attributes (CWE-915) in the TYPO3 Extension "Events 2". When a frontend user creates a new event without specifying an organizer, the system attributes the event to the submitting user's organizer record. However, the permission check only confirms that the user holds any organizer role, not that the user is authorized for the specific organizer assigned. This allows a user with frontend event management permissions to create events attributed to other organizers, potentially leading to unauthorized event creation under different organizer identities.

An attacker with frontend event management access can create events attributed to organizers they do not control. This could lead to unauthorized event creation under another organizer's identity, potentially causing data integrity issues or misuse of organizer privileges within the TYPO3 system. There is no indication of remote code execution or privilege escalation beyond the event attribution manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor the vendor's TYPO3 Extension "Events 2" advisories for updates and apply patches once available. Until then, restrict frontend event management access to trusted users only.