# CVE-2026-77128: TYPO3 sf_event_mgt broken access control on event visibility

Source: https://junglewise.ai/threats/cve-2026-77128-typo3-sf-event-mgt-broken-access-control-on-event-visibility  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77128 · Severity: info · CVSS 7.5 · Published 2026-08-25

TYPO3's "Event management and registration" extension fails to properly restrict access to hidden or time-restricted events. An unauthenticated attacker can bypass visibility controls by manipulating a query parameter, allowing them to view event details that should not be publicly accessible unless a specific plugin setting is enabled. This can lead to unauthorized disclosure of event information.

Vendors: [Typo3](https://junglewise.ai/threats/vendors/typo3).

## Quick answers

**Is CVE-2026-77128 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77128 being exploited in the wild.

**How severe is CVE-2026-77128?** Informational severity, with a CVSS score of 7.5, published 25 August 2026.

**Which products and versions are affected?** Typo3 Sf Event Mgt 5.9.2 and below, 6.0.0–6.7.1, 7.0.0–7.9.2, 8.0.0–8.6.1, 9.0.0–9.0.2.

**Is there a fix for CVE-2026-77128?** A patch was published on 2026-08-25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77128 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77128?** Check whether you run Typo3 Sf Event Mgt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The sf_event_mgt extension fails to enforce enable-field restrictions when processing repository query parameters. An unauthenticated remote attacker can pass a demand-override parameter to bypass access controls and view hidden or time-restricted events. The vulnerability exists in all affected versions unless the "disableOverrideDemand" plugin setting is explicitly enabled. No authentication or user interaction is required for exploitation; the attack is purely network-based and relies on the default insecure configuration. Patched versions (5.9.3, 6.7.2, 7.9.3, 8.6.2, 9.0.3) are available.

## Affected products

- TYPO3 sf_event_mgt 5.9.2 and below, 6.0.0–6.7.1, 7.0.0–7.9.2, 8.0.0–8.6.1, 9.0.0–9.0.2

## Timeline

- 2026-08-25: disclosed
- 2026-08-25: patched

## References

- [https://packagist.org/](https://packagist.org/)
- [https://typo3.org/security/advisory/typo3-ext-sa-2026-023](https://typo3.org/security/advisory/typo3-ext-sa-2026-023)

## Related threats

- [TYPO3 sf_event_mgt Server-Side Template Injection in email subject](https://junglewise.ai/threats/cve-2026-77129-typo3-sf-event-mgt-server-side-template-injection-in-email)