Description
The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TYPO3 | Extension "Events 2" | 10.0.0 – < 10.2.12, 9.0.0 – < 9.4.2, < 8.6.3 | 10.2.12 |
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-026 vendor-advisory