CVE-2020-25026

Information Disclosure in TYPO3 extension sf_event_mgt

4.3 MediumFix available

The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure (participant data, and event data via email) because of Broken Access Control.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.77%Up 0.1 points since Apr 14, 2021

What each source reports

NVD Score used 4.3

Record: CVE-2020-25026
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2020-25026
Updated: 2026-11-02

EUVDEUVD-2020-1055 No score

Record: EUVD-2020-1055
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g8rg-7rpr-cwr2 4.3

Information Disclosure in TYPO3 extension sf_event_mgt

A missing access check in the backend module allows an authenticated backend user to export participant data for events which the user does not have access to, resulting in Information Disclosure.

Another missing access check in the backend module allows an authenticated backend user to send emails to event participants for events which the user does not have access to, resulting in Broken Access Control.

External reference: https://typo3.org/security/advisory/typo3-ext-sa-2020-017

Record: GHSA-g8rg-7rpr-cwr2
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSV 4.3

Record: CVE-2020-25026
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVGHSA-g8rg-7rpr-cwr2 4.3

Information Disclosure in TYPO3 extension sf_event_mgt

A missing access check in the backend module allows an authenticated backend user to export participant data for events which the user does not have access to, resulting in Information Disclosure.

External reference: https://typo3.org/security/advisory/typo3-ext-sa-2020-017

Record: GHSA-g8rg-7rpr-cwr2
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-863
Updated: 2026-11-02

Affected products

derhansen event management and registration

Affected packages

Affected packages
Package	Affected	Fixed
`derhansen/sf_event_mgt` Packagist	before 4.3.1	4.3.1
`derhansen/sf_event_mgt` Packagist	5.0.0 up to 5.1.1	5.1.1
`derhansen/sf_event_mgt` Packagist	before 4.3.1, plus listed versions 1.2.01.4.01.4.11.5.01.6.0 Show 26 moreShow less 1.6.11.7.01.7.11.8.01.8.12.0.02.1.03.0.03.0.13.0.23.0.33.0.43.0.53.0.63.0.73.0.84.0.04.0.14.1.04.1.14.1.24.1.34.2.04.2.14.2.24.3.0	4.3.1
`derhansen/sf_event_mgt` Packagist	5.0.0 up to 5.1.1, plus listed versions 5.0.15.1.0	5.1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-25026 is a medium vulnerability (CVSS 4.3) in Derhansen Event Management And Registration, published September 2, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in derhansen/sf_event_mgt 4.3.1.