TYPO3 femanager CVE-2026-77135

Exploitation requires that the femanager extension is installed on the TYPO3 instance and that at least one page containing the femanager Detail or List plugin is publicly accessible without frontend authentication. The AT:P prerequisite in the CVSS 4.0 vector reflects this plugin-availability dependency. What limits exploitation: if femanager Detail and List plugin pages are placed behind a TYPO3 frontend login wall (requiring authenticated frontend users), the IDOR remains exploitable by any authenticated frontend user performing horizontal privilege escalation against other users' records - it is not fully mitigated by requiring login. Exploitation is constrained to confidentiality impact only; no write access to user records or system-level impact is implied. TYPO3 installations that do not use the femanager extension, or that have not deployed Detail or List plugins on any page, are not affected.

The CVSS 4.0 base score of 8.2 (High) reflects a network-accessible, unauthenticated confidentiality breach with no integrity or availability impact. The AT:P (Attack Requirements: Present) metric is the critical moderating factor: exploitation is conditional on the femanager Detail or List plugin being deployed and publicly reachable, which is precisely its intended use-case deployment, making the prerequisite low-friction in practice. VC:H confirms that full frontend user profile records - including PII such as email, date of birth, and address - are exposed. There is no EPSS data available in the source intelligence, and the vulnerability is not listed in CISA KEV, suggesting no confirmed mass exploitation. The absence of Integrity and Availability impact (VI:N, VA:N, SC:N, SI:N, SA:N) limits the attack surface to data exfiltration. Real-world risk is meaningful for any TYPO3 installation using femanager for customer or member self-service portals where user PII is stored; the GDPR and data-protection exposure for affected organisations elevates operational impact beyond the technical CVSS score alone.

An unauthenticated attacker visits a publicly accessible TYPO3 page that renders the femanager Detail plugin and appends or modifies the uid parameter in the request (e.g., ?tx_femanager_pi1[user]=42) to enumerate integer user IDs sequentially, harvesting full profile records - name, email, date of birth, and address - for every registered frontend user without any credentials. No public exploit code has been identified at time of analysis, but the technique requires no specialised tooling beyond a basic HTTP client or browser.