Auth bypass in TYPO3 Extension "Event Management And Registration"
CVE-2026-77128
The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires only that disableOverrideDemand is not enabled.
Vulnerability class: Broken Access Control
EPSS: 0.004 (29.9th percentile) — read the EPSS interpretation.
Affected products
Weakness classification (CWE)
References
- f4fb688c-4412-4426-b4b8-421ecf27b14a (vendor-advisory)