CVE-2026-77145 — Broken Access Control in extension "Events 2" (events2)
The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access …
Published: 2026-08-25 · CVSS: 7.1 · CVSS 4.0
The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7