CVE-2026-77128

MediumCVSS 6.3/10Last modified Aug 26, 2026

Description

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires only that disableOverrideDemand is not enabled.

Metrics

CVSS 4.0 6.3/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-771297.7The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user w CVE-2026-77136.3A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this vulnerability is the function generate_au CVE-2026-771305.3The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key t CVE-2026-771315.3When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitat CVE-2026-771325.3It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowe CVE-2026-771336.0The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses CVE-2026-771348.3The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmat CVE-2026-771358.2The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visit CVE-2026-771369.5The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as CVE-2026-771377.7The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inje CVE-2026-771389.3The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, una CVE-2026-771396.0The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask temp