TYPO3 Extension Events 2 vulnerabilities

2 CVEs affecting TYPO3 Extension Events 2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-77145, published 2026-08-25.

More from TYPO3.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-77144, published 2026-08-25. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check…
• CVE-2026-77145, published 2026-08-25. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify…