CVE-2026-77144
Description
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event management access could therefore create an event that is attributed to another organizer.
Is your site exposed to CVE-2026-77144?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Other References
Frequently Asked Questions
What is CVE-2026-77144? +
How do I check if I'm vulnerable to CVE-2026-77144? +
Related Vulnerabilities
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control …
Craft CMS is a content management system (CMS). Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in …
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the …
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in …
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, …
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, …