CVE-2026-77128

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, provided that the disableOverrideDemand plugin setting is not active.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Enable the disableOverrideDemand plugin setting to prevent the use of the demand-override parameter.