Executive brief
The Events 2 extension for TYPO3 is a plugin that manages event creation and editing on websites. A user with permission to create events on the frontend could create events and falsely attribute them to other organizers, potentially allowing unauthorized modifications to another organization's event records and disrupting event management operations.
Technical details
This vulnerability is a broken access control flaw (CWE-639, CWE-915) in the TYPO3 Events 2 extension frontend event management plugin. When creating a new event, the plugin fails to validate ownership: if a request omits the organizer field, the event defaults to the submitting user's organizer; however, the permission check only verifies that the user holds *any* organizer role, not that they own the target organizer. An authenticated attacker with frontend event management access can craft a request specifying another organizer and the weak permission check will allow the event creation, resulting in unauthorized event attribution. Patched versions 8.6.3, 9.4.2, and 10.2.12 are available.
Affected products
- JWeiland Events 2 8.6.2 and below, 9.0.0-9.4.1, 10.0.0-10.2.11
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: versions 8.6.3, 9.4.2, 10.2.12 released