CVE-2026-77145: CWE-639 Authorization Bypass Through User-Controlled Key in TYPO3 Extension "Events 2"

The vulnerability in TYPO3 Extension "Events 2" arises from an authorization bypass due to a mismatch in event verification during the frontend management update flow. Specifically, the permission check validates one event, but the request modifies another, enabling unauthorized modification of events by users with frontend event management privileges. This is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 4.0 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, low confidentiality impact, high integrity impact, and no availability impact.

An attacker with frontend event management access can modify events that belong to other organizers, potentially leading to unauthorized changes in event data. This compromises the integrity of event information within the TYPO3 Extension "Events 2". There is no indication of confidentiality or availability impact beyond the integrity breach.

No official patch or remediation level has been provided yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict frontend event management access to trusted users only and monitor for suspicious modification activity related to events.