Skip to main content

TYPO3 femanager EUVDEUVD-2026-65330

| CVE-2026-77146 HIGH
Missing Authorization (CWE-862)
2026-08-25 TYPO3 GHSA-ccrq-xx5g-x98r
Authentication Bypass Extension Femanager
8.3
CVSS 4.0 · Vendor: TYPO3
Share

Severity by source

Vendor (TYPO3) PRIMARY
8.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.2 HIGH

Network-reachable, no authentication needed, no user interaction; integrity is high due to arbitrary password reset; confidentiality low as account re-enablement leaks minimal data.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TYPO3).

CVSS VectorVendor: TYPO3

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 25, 2026 - 11:01 EUVD
Analysis Generated
Aug 25, 2026 - 09:39 vuln.today
CVE Published
Aug 25, 2026 - 09:00 cve.org
HIGH 8.3

DescriptionCVE.org

The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is only present in the 8.x versions of the extension.

AnalysisAI

Unauthenticated account takeover in the TYPO3 femanager extension 8.x allows a remote attacker to reset the password of and re-enable any existing frontend user account - including disabled or deleted ones - by exploiting an invitation controller that continues processing after issuing a redirect on invalid input. No prior authentication or user interaction is required. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify TYPO3 site with femanager 8.x
Delivery
Enumerate valid frontend username
Exploit
Submit invitation request with invalid/missing hash
Execution
Controller redirects but continues execution
Persist
Supply attacker-controlled new password
Impact
Log in as compromised frontend user
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the following specific conditions: (1) The target TYPO3 installation must be running femanager version 8.x - other major versions are not affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) characterizes this as a network-accessible, unauthenticated attack with no user interaction required, but with an Attack Requirement of 'Present' (AT:P), indicating that a specific precondition must hold - most likely knowledge of a valid frontend username or account identifier on the target system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker identifies a TYPO3 site running femanager 8.x, enumerates or guesses a valid frontend username (often discoverable via public profile pages or predictable naming conventions in CMS deployments). The attacker then crafts a request to the invitation controller with a missing or invalid hash; the controller redirects on the error but continues executing, allowing the attacker to supply a new password for the target account and re-enable it if disabled. …
Remediation The primary remediation is to upgrade femanager to a patched version per the TYPO3 security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-024. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all TYPO3 instances and identify those running femanager 8.x; restrict network access to password reset functionality and enable detailed logging of authentication and account modification events. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Extension Femanager

View all
CVE-2026-77134 HIGH
8.3 Aug 25

The femanager extension for TYPO3 CMS incorrectly accepts a regular user confirmation hash - obtainable by any visitor v
CVE-2026-77135 HIGH
8.2 Aug 25

Insecure Direct Object Reference in the TYPO3 femanager extension exposes frontend user profile data - including name, e
CVE-2026-77133 MEDIUM
6.0 Aug 25

Self-service privilege escalation in the TYPO3 femanager (Frontend User Manager) extension allows any authenticated fron

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-65330 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy