EUVD-2026-65341
GHSA-279q-wx34-jv34
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable plugin, no authentication or user interaction needed, confidentiality-only impact on vulnerable system with unchanged scope.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying an arbitrary user ID.
AnalysisAI
Insecure Direct Object Reference in the TYPO3 femanager extension exposes frontend user profile data - including name, email address, date of birth, and postal address - to any unauthenticated visitor who can reach the Detail or List plugin. The extension's user detail view accepts a caller-supplied user ID without validating that the requested record belongs to the configured or authenticated target, making horizontal privilege escalation trivial via ID enumeration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the femanager extension is installed on the TYPO3 instance and that at least one page containing the femanager Detail or List plugin is publicly accessible without frontend authentication. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.2 (High) reflects a network-accessible, unauthenticated confidentiality breach with no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker visits a publicly accessible TYPO3 page that renders the femanager Detail plugin and appends or modifies the uid parameter in the request (e.g., ?tx_femanager_pi1[user]=42) to enumerate integer user IDs sequentially, harvesting full profile records - name, email, date of birth, and address - for every registered frontend user without any credentials. No public exploit code has been identified at time of analysis, but the technique requires no specialised tooling beyond a basic HTTP client or browser. |
| Remediation | The primary fix is to update the femanager extension to the patched release identified in the vendor advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-024; a specific patched version number is not confirmed in the available intelligence and should be taken directly from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all TYPO3 installations to identify femanager extension deployment and immediately disable or restrict access to the affected Detail and List plugins. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Extension Femanager
View allUnauthenticated account takeover in the TYPO3 femanager extension 8.x allows a remote attacker to reset the password of
The femanager extension for TYPO3 CMS incorrectly accepts a regular user confirmation hash - obtainable by any visitor v
Self-service privilege escalation in the TYPO3 femanager (Frontend User Manager) extension allows any authenticated fron
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today