CVE-2026-77145: Frontend Event Management Auth Bypass Flaw

CVE-2026-77145 Overview

CVE-2026-77145 is a broken access control vulnerability [CWE-639] affecting the TYPO3 frontend event management update flow. The permission check validated a different event than the one the request actually modified. Authenticated users with frontend event management access can therefore modify events owned by other organizers.

The flaw is tracked in TYPO3 Security Advisory #2026-026 and requires low-privilege network access with no user interaction.

Critical Impact
Authenticated frontend users can tamper with event records belonging to other organizers, undermining data integrity across tenants sharing the same TYPO3 instance.

Affected Products

TYPO3 event management extension (see TYPO3 Security Advisory #2026-026 for affected versions)
Deployments exposing frontend event management to authenticated users
Multi-organizer TYPO3 instances relying on per-event authorization

Discovery Timeline

2026-08-25 - CVE-2026-77145 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-77145

Vulnerability Analysis

The vulnerability sits in the frontend management update flow of a TYPO3 event extension. The application performs an authorization check against an event identifier supplied for verification purposes. It then applies the update to a different event identifier passed elsewhere in the same request.

This mismatch means the access control decision does not bind to the object being modified. An authenticated user who legitimately owns event A can pass A to the permission check and simultaneously submit modifications targeting event B belonging to another organizer.

The classification [CWE-639] describes Authorization Bypass Through User-Controlled Key. The application trusts a user-supplied key for authorization while operating on a separate user-supplied key for the mutation.

Root Cause

The root cause is inconsistent object referencing between authorization and business logic layers. The permission check and the update operation resolve event identifiers independently rather than binding the authorization decision to the exact object being modified. No server-side reconciliation confirms the two identifiers refer to the same event.

Attack Vector

An attacker requires a valid frontend account with event management permissions on at least one event. The attacker crafts an HTTP request that references an owned event in the field consulted by the permission check while targeting a victim event in the update payload. The server authorizes the request and applies the change to the victim event. Exploitation is network-based, low-complexity, and requires no user interaction.

Refer to the TYPO3 Security Advisory #2026-026 for parameter-level technical details.

Detection Methods for CVE-2026-77145

Indicators of Compromise

Update requests to the frontend event management endpoint where the authorization parameter and target event identifier resolve to different organizers.
Modifications to event records by frontend users who are not listed as organizers or editors of those events.
Audit log entries showing unexpected changes to event titles, dates, or descriptions immediately following requests from unrelated user sessions.

Detection Strategies

Compare the event identifier used for permission validation against the identifier actually modified in application audit logs.
Alert on frontend event update requests whose acting user does not match the organizer of the resulting modified record.
Baseline normal editing patterns per organizer and flag cross-organizer modifications as anomalies.

Monitoring Recommendations

Enable verbose logging on the TYPO3 frontend event management controller, including both authorization inputs and mutation targets.
Forward web server and application logs to a central analytics platform for correlation across organizer boundaries.
Review database change logs on event tables for updates originating from users without a legitimate ownership relationship.

How to Mitigate CVE-2026-77145

Immediate Actions Required

Apply the fixed extension version referenced in TYPO3 Security Advisory #2026-026 as soon as it is available in your environment.
Audit event records for unauthorized modifications since the vulnerable extension was deployed, focusing on cross-organizer changes.
Restrict frontend event management permissions to trusted users until the patch is applied.

Patch Information

The TYPO3 security team has published remediation guidance in TYPO3 Security Advisory #2026-026. Administrators should upgrade the affected extension to the fixed release identified in that advisory. No vendor CPE data was published in NVD at the time of writing, so confirm the affected version range directly against the advisory.

Workarounds

Temporarily disable frontend event editing and require backend administrators to perform updates until the patch is applied.
Reduce the frontend user group membership for event management to a small, trusted set of organizers.
Add a reverse proxy or web application firewall rule that rejects update requests where the authorization event identifier and payload event identifier differ.

bash

# Example: temporarily restrict frontend event management group membership in TYPO3
# Review and reduce the frontend user group used by the event extension
# (adjust the group UID and table name to match your installation)
UPDATE fe_users
SET usergroup = REPLACE(usergroup, ',<event_manager_group_uid>', '')
WHERE FIND_IN_SET('<event_manager_group_uid>', usergroup)
  AND uid NOT IN (<list_of_trusted_organizer_uids>);