CVE-2026-77128: Information Disclosure Vulnerability

CVE-2026-77128 Overview

CVE-2026-77128 is a missing authorization vulnerability [CWE-862] affecting a TYPO3 extension. The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote attacker can supply a demand-override parameter to view hidden or time-restricted events. Exploitation requires that the disableOverrideDemand plugin setting is not active. The issue affects confidentiality of records that administrators intended to hide or gate by time windows.

Critical Impact
Unauthenticated remote users can bypass enable-field restrictions and disclose hidden or time-restricted event records when disableOverrideDemand is disabled.

Affected Products

TYPO3 extension covered by advisory TYPO3-EXT-SA-2026-023
Installations where the disableOverrideDemand plugin setting is not enabled
Public-facing TYPO3 sites exposing the affected repository query parameter

Discovery Timeline

2026-08-25 - CVE-2026-77128 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77128

Vulnerability Analysis

The vulnerability resides in a TYPO3 extension repository query path that accepts a demand-override parameter from the request. The extension does not enforce enable-field restrictions when this override is supplied. Enable fields in TYPO3 control visibility flags such as hidden state, deletion state, and start or end time windows. Bypassing these fields allows a caller to retrieve records the site owner marked as not publicly visible.

The advisory classifies the flaw under CWE-862: Missing Authorization. The attack requires no authentication and no user interaction, and the parameter is reachable across the network on any installation exposing the affected plugin.

Root Cause

The extension trusts a client-supplied demand-override parameter and skips enable-field checks during repository query construction. The disableOverrideDemand plugin setting exists as a mitigation switch, but it is not enforced by default. When the switch is off, the repository layer honors the override and returns records that should have been filtered by the enable-field logic.

Attack Vector

An attacker sends a crafted HTTP request that includes the demand-override parameter to the plugin endpoint. The extension parses the parameter, disables the standard enable-field constraints on the query, and returns event records including those marked hidden or scheduled outside the current visibility window. No credentials, session, or user interaction are required.

Refer to the TYPO3 Security Advisory TYPO3-EXT-SA-2026-023 for the vendor description of the affected code path.

Detection Methods for CVE-2026-77128

Indicators of Compromise

HTTP requests containing demand-override query parameters targeting the affected TYPO3 plugin endpoints
Access log entries showing anonymous retrieval of event records that carry hidden or time-restricted enable-field values
Response payloads to unauthenticated clients that include records outside the configured starttime or endtime window

Detection Strategies

Review web server and TYPO3 access logs for query strings that include demand or override keys against the vulnerable plugin
Correlate anonymous access patterns to endpoints that return event data with hidden records present in the response
Audit the plugin configuration to confirm whether disableOverrideDemand is enabled across all site instances

Monitoring Recommendations

Alert on repeated anonymous requests to the affected plugin that carry demand-override parameters
Track volume of records returned per request and flag responses that exceed expected public dataset size
Monitor changes to TYPO3 extension configuration files for regressions in the disableOverrideDemand setting

How to Mitigate CVE-2026-77128

Immediate Actions Required

Apply the fixed extension release referenced in TYPO3-EXT-SA-2026-023
Enable the disableOverrideDemand plugin setting on all affected TYPO3 instances until patching is complete
Audit exposed event records to determine whether hidden or time-restricted content was accessed by unauthenticated callers

Patch Information

The TYPO3 project publishes fixed versions and remediation guidance in the TYPO3 Security Advisory TYPO3-EXT-SA-2026-023. Administrators should upgrade the affected extension to the patched release identified in that advisory.

Workarounds

Set disableOverrideDemand to active in the plugin configuration to block the parameter override
Restrict access to the affected plugin endpoint via web application firewall rules that drop demand-override query parameters
Remove or disable the extension on sites that do not require its functionality until the patched version is deployed

bash

# Configuration example: enable the mitigation flag in TypoScript
plugin.tx_<extension_key>.settings.disableOverrideDemand = 1