femanager TYPO3 CVE-2026-77133

Exploitation requires: (1) the target TYPO3 site must have the femanager extension installed with the profile edit plugin active; (2) the profile edit plugin must be using its default field configuration - installations where the usergroup assignment field has been explicitly disabled or restricted in the plugin settings are NOT vulnerable; (3) the attacker must hold a valid authenticated frontend user session (PR:L - unauthenticated exploitation is not possible). Exploitation is limited to frontend user group escalation and does not directly affect backend administrator accounts. The AT:P requirement in the CVSS 4.0 vector confirms the default-configuration prerequisite as a concrete limiting factor.

The CVSS 4.0 score of 6.0 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N reflects a meaningful but gated risk: network reachable, low complexity, but requiring both an authenticated session (PR:L) and a specific deployment condition (AT:P - default field configuration). The high vulnerable-system confidentiality impact (VC:H) reflects that gaining membership in a privileged frontend group could expose protected content, members-only resources, or administrative frontend functions. No EPSS data was provided, limiting probabilistic exploitation assessment. KEV status is absent and no public POC is referenced, indicating no confirmed active exploitation at time of analysis. The practical risk is concentrated on TYPO3 sites using femanager for community or subscription features where frontend group membership gates access to sensitive material. Sites that have customized the profile edit plugin's field configuration to restrict or remove the groups field are not affected. The AT:P prerequisite is significant: default configuration is common among deployments that have not explicitly hardened femanager, so the effective vulnerable population is non-trivial. CVSS signals and description are consistent - no contradictions identified.

An attacker with a valid low-privilege frontend user account on a TYPO3 site (e.g., a free-tier member or registered community user) navigates to the self-service profile edit page rendered by femanager. By manipulating the group assignment field in the submitted form - either through browser developer tools or a crafted HTTP request - the attacker includes the identifier of a privileged frontend group (such as a paid-subscription or administrator group). Because the extension lacks server-side authorization validation on this field in its default configuration, TYPO3 persists the new group membership. The attacker now has access to all content and features gated behind that privileged group. No public exploit code has been identified at time of analysis.