Is CVE-2026-77128 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77128 being exploited in the wild.

How severe is CVE-2026-77128?

Informational severity, with a CVSS score of 7.5, published 25 August 2026.

Which products and versions are affected?

Typo3 Sf Event Mgt 5.9.2 and below, 6.0.0–6.7.1, 7.0.0–7.9.2, 8.0.0–8.6.1, 9.0.0–9.0.2.

Is there a fix for CVE-2026-77128?

A patch was published on 2026-08-25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77128 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77128?

Check whether you run Typo3 Sf Event Mgt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77128: TYPO3 sf_event_mgt broken access control on event visibility

CVE-2026-77128 · Severity: info · CVSS 7.5 · Published 2026-08-25

TYPO3's "Event management and registration" extension fails to properly restrict access to hidden or time-restricted events. An unauthenticated attacker can bypass visibility controls by manipulating a query parameter, allowing them to view event details that should not be publicly accessible unless a specific plugin setting is enabled. This can lead to unauthorized disclosure of event information.

Vendors: Typo3.

Quick answers

Is CVE-2026-77128 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77128 being exploited in the wild.
How severe is CVE-2026-77128?: Informational severity, with a CVSS score of 7.5, published 25 August 2026.
Which products and versions are affected?: Typo3 Sf Event Mgt 5.9.2 and below, 6.0.0–6.7.1, 7.0.0–7.9.2, 8.0.0–8.6.1, 9.0.0–9.0.2.
Is there a fix for CVE-2026-77128?: A patch was published on 2026-08-25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77128 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77128?: Check whether you run Typo3 Sf Event Mgt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The sf_event_mgt extension fails to enforce enable-field restrictions when processing repository query parameters. An unauthenticated remote attacker can pass a demand-override parameter to bypass access controls and view hidden or time-restricted events. The vulnerability exists in all affected versions unless the "disableOverrideDemand" plugin setting is explicitly enabled. No authentication or user interaction is required for exploitation; the attack is purely network-based and relies on the default insecure configuration. Patched versions (5.9.3, 6.7.2, 7.9.3, 8.6.2, 9.0.3) are available.

Affected products

TYPO3 sf_event_mgt 5.9.2 and below, 6.0.0–6.7.1, 7.0.0–7.9.2, 8.0.0–8.6.1, 9.0.0–9.0.2

Timeline

2026-08-25: disclosed
2026-08-25: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.