TYPO3-EXT-SA-2026-023: Multiple vulnerabilities in extension "Event management and registration" (sf_event_mgt)
It has been discovered that the extension "Event management and registration" (sf_event_mgt) is vulnerable to Broken Access Control and Server-Side Template Injection (SSTI).
- Release Date: August 25, 2026
- Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
- Component: "Event management and registration" (sf_event_mgt)"
- Composer Package Name: derhansen/sf_event_mgt
- Vulnerability Type: Server-Side Template Injection (SSTI)
- Affected Versions: 5.9.2 and below, 6.0.0 - 6.7.1, 7.0.0 - 7.9.2, 8.0.0 - 8.6.1, 9.0.0 - 9.0.2
- Severity: High
- Suggested CVSS v4.0: AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- References: CVE-2026-77128, CVE-2026-77129, CWE-862, CWE-1336
Problem Description
The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the "disableOverrideDemand" plugin setting is active. Exploitation of this issue requires only that "disableOverrideDemand" is not enabled. (CVE-2026-77128)
The extension also passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation of this issue requires an authenticated backend account with edit access to the event registration plugin or access to the backend module. (CVE-2026-77129)
Solution
Updated versions 5.9.3, 6.7.2, 7.9.3, 8.6.2 and 9.0.3 are available from the TYPO3 extension manager, packagist and at
https://extensions.typo3.org/extension/download/sf_event_mgt/5.9.3/zip
https://extensions.typo3.org/extension/download/sf_event_mgt/6.7.2/zip
https://extensions.typo3.org/extension/download/sf_event_mgt/7.9.3/zip
https://extensions.typo3.org/extension/download/sf_event_mgt/8.6.2/zip
https://extensions.typo3.org/extension/download/sf_event_mgt/9.0.3/zip
Users of the extension are advised to update the extension as soon as possible.
Credits
Thanks to TYPO3 Security Team Member Torben Hansen for reporting the vulnerabilities and for providing updated versions of the extension.
General Advice
Follow the recommendations that are given in the TYPO3 Security Guide.
