TYPO3 femanager EUVD-2026-65330

Exploitation requires the following specific conditions: (1) The target TYPO3 installation must be running femanager version 8.x - other major versions are not affected. (2) The invitation controller must be reachable, meaning the femanager frontend user invitation or registration workflow must be enabled and publicly accessible. (3) The attacker must supply a valid existing frontend username or account identifier as the target - accounts that do not exist cannot be targeted, but disabled and deleted accounts are explicitly in scope per the description. What limits exploitation: the AT:P metric in the CVSS 4.0 vector confirms a specific attack precondition (likely username enumeration); accounts on TYPO3 backend (administrator) are out of scope - only frontend user accounts managed by femanager are affected; and sites that have not deployed femanager 8.x or have disabled invitation workflows are not exposed.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) characterizes this as a network-accessible, unauthenticated attack with no user interaction required, but with an Attack Requirement of 'Present' (AT:P), indicating that a specific precondition must hold - most likely knowledge of a valid frontend username or account identifier on the target system. The VI:H (high integrity impact) reflects the ability to arbitrarily reset account credentials and re-enable disabled accounts. Neither CISA KEV inclusion nor public proof-of-concept code has been identified, so real-world exploitation at scale is not confirmed. EPSS data is absent from available intelligence. Despite the lack of confirmed exploitation, the combination of zero required privileges, network accessibility, and direct account-takeover impact means that even a small organization managing sensitive frontend user data should treat this as urgent and patch immediately rather than waiting for broader threat intelligence. The AT:P modifier is the primary risk limiter: an attacker must be able to identify or enumerate valid frontend usernames, which is often trivial in CMS environments where usernames are publicly visible or guessable. There is no CVSS 3.1 vector in the source data - the base vector is expressed exclusively in CVSS 4.0 format.

An attacker identifies a TYPO3 site running femanager 8.x, enumerates or guesses a valid frontend username (often discoverable via public profile pages or predictable naming conventions in CMS deployments). The attacker then crafts a request to the invitation controller with a missing or invalid hash; the controller redirects on the error but continues executing, allowing the attacker to supply a new password for the target account and re-enable it if disabled. The attacker then logs in as the victim frontend user. No public exploit code has been identified at time of analysis.