A flaw in the TYPO3 extension "Events 2" permits a user with frontend event‑management privileges to create a new event that is assigned to another organizer when the request does not specify an organizer. The plugin only recognises that the submitting user holds an organizer role, but it does not check whether the organizer field is meant for the intended target. This missing validation is a classic broken access control weakness (CWE‑915) that lets an attacker add events under a different organizer’s identity, potentially misleading attendees, tampering data, or compromising the integrity of an organizer’s schedule.

The vulnerability affects the TYPO3 extension "Events 2". No specific version numbers are listed; therefore any installation of this extension that has not applied a fix issued by the vendor is potentially affected.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must first obtain frontend event‑management access and is then able to create an event attributed to another organizer. The attack vector is likely local through the web interface, requiring authenticated access to the extension’s event‑creation routine. The risk is moderate to high due to the impact on data integrity and the ease of exploitation once the required privileges are present.