{"id":"CVE-2026-77144","title":"The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own","summary":"The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user h…","severity":"none","cwe":["CWE-915"],"published":"2026-08-25","updated":"2026-09-28","sourceUpdated":"2026-09-28T23:10:00.143","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77144","references":[{"url":"https://typo3.org/security/advisory/typo3-ext-sa-2026-026","label":"f4fb688c-4412-4426-b4b8-421ecf27b14a"}],"tags":["nvd"],"ingestedAt":"2026-09-28T23:23:00.543Z","slug":"CVE-2026-77144","body":"## Overview\n\nThe frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event management access could therefore create an event that is attributed to another organizer.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}