Executive brief
TYPO3's "Event management and registration" extension fails to properly restrict access to hidden or time-restricted events. An unauthenticated attacker can bypass visibility controls by manipulating a query parameter, allowing them to view event details that should not be publicly accessible unless a specific plugin setting is enabled. This can lead to unauthorized disclosure of event information.
Technical details
The sf_event_mgt extension fails to enforce enable-field restrictions when processing repository query parameters. An unauthenticated remote attacker can pass a demand-override parameter to bypass access controls and view hidden or time-restricted events. The vulnerability exists in all affected versions unless the "disableOverrideDemand" plugin setting is explicitly enabled. No authentication or user interaction is required for exploitation; the attack is purely network-based and relies on the default insecure configuration. Patched versions (5.9.3, 6.7.2, 7.9.3, 8.6.2, 9.0.3) are available.
Affected products
- TYPO3 sf_event_mgt 5.9.2 and below, 6.0.0–6.7.1, 7.0.0–7.9.2, 8.0.0–8.6.1, 9.0.0–9.0.2
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched