Typo3 Extension "Femanager" vulnerabilities
5 vulnerabilities
Known vulnerabilities in Typo3 Extension "Femanager", newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2026-77133typo3 · extension "femanager"Broken Access Control in extension "femanager" (femanager)The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.CVSS6.0MediumEPSS0.35%PrioritiseCVE-2026-77134typo3 · extension "femanager"Broken Access Control in extension "femanager" (femanager)The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval.CVSS8.3HighEPSS0.41%PrioritiseCVE-2026-77135typo3 · extension "femanager"Information Disclosure in extension "femanager" (femanager)The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying an arbitrary user ID.CVSS8.2HighEPSS0.41%PrioritiseCVE-2026-77146typo3 · extension "femanager"Broken Access Control in extension "femanager" (femanager)The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is only present in the 8.x versions of the extension.CVSS8.3HighEPSS0.42%RoutineCVE-2025-7900typo3 · extension "femanager" +1 moreInsecure Direct Object Reference in extension "femanager" (femanager)The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0CVSS6.5MediumEPSS0.25%