CVE-2026-77128: Broken Access Control in extension "Event management and registration" (sf_event_mgt)

Published Aug 25, 2026

Updated

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires only that disableOverrideDemand is not enabled.

Affected Software

1 affected component

sf_event_mgt

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Activate/enable the extension setting disableOverrideDemand so unauthenticated users cannot pass a demand-override parameter to view hidden or time-restricted events.
Event management and registration (sf_event_mgt) disableOverrideDemand = active

Event History

Aug 25, 2026

CVE Published

via MITRE·09:00 AM

Data Sourced

via MITRE·09:00 AM

DescriptionWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using sf_event_mgt are exposed when the disableOverrideDemand plugin setting is not enabled. The affected query can be reached by an unauthenticated remote user.

What can an attacker access?

An attacker can supply a demand-override parameter to view events that are hidden or restricted by time-based publication settings. The described impact is disclosure of event information.

Is authentication or user interaction required for exploitation?

No. Exploitation is remote and unauthenticated, and does not require user interaction.

What mitigation is available if patching cannot be performed immediately?

Enable the disableOverrideDemand plugin setting. The issue requires that this setting is not enabled.

CVE-2026-77128: Broken Access Control in extension "Event management and registration" (sf_event_mgt)

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What can an attacker access?

Is authentication or user interaction required for exploitation?

What mitigation is available if patching cannot be performed immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What can an attacker access?

Is authentication or user interaction required for exploitation?

What mitigation is available if patching cannot be performed immediately?