Skip to main content

femanager TYPO3 CVE-2026-77133

| EUVDEUVD-2026-65343 MEDIUM
Missing Authorization (CWE-862)
2026-08-25 TYPO3 GHSA-qjph-66v6-w5fp
Privilege Escalation Authentication Bypass Extension Femanager
6.0
CVSS 4.0 · Vendor: TYPO3
Share

Severity by source

Vendor (TYPO3) PRIMARY
6.0 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.1 HIGH

Network reachable via profile edit form, authenticated session required (PR:L), no user interaction; high confidentiality from group escalation, low integrity from self-modification only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TYPO3).

CVSS VectorVendor: TYPO3

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Aug 25, 2026 - 11:01 EUVD
Analysis Generated
Aug 25, 2026 - 09:47 vuln.today

DescriptionCVE.org

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.

AnalysisAI

Self-service privilege escalation in the TYPO3 femanager (Frontend User Manager) extension allows any authenticated frontend user to assign themselves to arbitrary frontend usergroups via the profile edit plugin when operating under its default field configuration. The root cause is CWE-862 (Missing Authorization): the extension does not validate whether the requesting user is permitted to join the target group before processing the self-update. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as low-privilege frontend user
Delivery
Access profile edit page rendered by femanager
Exploit
Submit modified form with target group identifier
Execution
Extension skips authorization check on group field
Persist
TYPO3 persists elevated group membership
Impact
Access privileged frontend content or features
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires: (1) the target TYPO3 site must have the femanager extension installed with the profile edit plugin active; (2) the profile edit plugin must be using its default field configuration - installations where the usergroup assignment field has been explicitly disabled or restricted in the plugin settings are NOT vulnerable; (3) the attacker must hold a valid authenticated frontend user session (PR:L - unauthenticated exploitation is not possible). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.0 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N reflects a meaningful but gated risk: network reachable, low complexity, but requiring both an authenticated session (PR:L) and a specific deployment condition (AT:P - default field configuration). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a valid low-privilege frontend user account on a TYPO3 site (e.g., a free-tier member or registered community user) navigates to the self-service profile edit page rendered by femanager. By manipulating the group assignment field in the submitted form - either through browser developer tools or a crafted HTTP request - the attacker includes the identifier of a privileged frontend group (such as a paid-subscription or administrator group). …
Remediation The primary remediation is to apply the patched version of the femanager extension as detailed in the TYPO3 security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-024; an exact fix version was not confirmed from available intelligence data and must be retrieved from the advisory directly. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Extension Femanager

View all
CVE-2026-77146 HIGH
8.3 Aug 25

Unauthenticated account takeover in the TYPO3 femanager extension 8.x allows a remote attacker to reset the password of

CVE-2026-77134 HIGH
8.3 Aug 25

The femanager extension for TYPO3 CMS incorrectly accepts a regular user confirmation hash - obtainable by any visitor v
CVE-2026-77135 HIGH
8.2 Aug 25

Insecure Direct Object Reference in the TYPO3 femanager extension exposes frontend user profile data - including name, e

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

CVE-2026-77133 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy