CVE-2026-77145: CWE-639 Authorization Bypass Through User-Controlled Key in TYPO3 Extension "Events 2"

The TYPO3 Extension "Events 2" contains an authorization bypass vulnerability (CWE-639) where the permission check during the frontend event update process validates a different event than the one being modified. Consequently, an authenticated user with frontend event management privileges can alter events that belong to other organizers, bypassing intended access controls. The CVSS 4.0 score is 7.1 (high severity) with network attack vector, low attack complexity, no privileges required beyond frontend event management access, no user interaction, and high impact on integrity and availability.

An attacker with legitimate frontend event management access can modify events that they do not own or manage. This can lead to unauthorized changes to event data, potentially disrupting event operations or causing misinformation. There is no indication of privilege escalation beyond the frontend event management role or impact on confidentiality.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict frontend event management access to trusted users only to mitigate risk.