TYPO3 femanager EUVD-2026-65342

The admin-approval workflow feature of the femanager extension must be enabled and configured on the TYPO3 site - sites using femanager without this workflow are not affected. The attacker must be able to register a new account (i.e., user registration must be open or accessible to the attacker), placing it in the pending-approval state. The public resend-confirmation action must be accessible over the network, which is its intended operating mode. Limiting factors: sites that have closed registration, that do not use femanager's admin-approval feature, or that restrict the resend-confirmation endpoint are not exploitable. Authentication is not required at any step - the CVSS vector confirms PR:N.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N) scores 8.3, reflecting remote, unauthenticated exploitation with high confidentiality impact. The AT:P (attack requirements: present) modifier is the critical nuance: the admin-approval workflow must be enabled on the target TYPO3 site, meaning this is not exploitable in default or minimal femanager deployments that omit that feature. However, sites that deploy the admin-approval workflow specifically because they want controlled access - community portals, member intranets, subscriber platforms - are precisely the deployments where unauthorized account activation is most consequential. No EPSS data was provided, and the vulnerability is absent from CISA KEV at time of analysis, so no external threat-intelligence signal validates active exploitation; exploitation priority cannot be confirmed from available data. The absence of KEV listing should not lower urgency: the attack requires no elevated skill, no authentication, and no victim interaction, making it highly automatable once the prerequisite condition (an account in pending-approval state) is met - a condition the attacker can create themselves by registering. The integrity impact is assessed low (VI:L) and availability is unaffected (VA:N), bounding the worst-case outcome to unauthorized content or feature access rather than system-wide compromise.

An attacker registers a new account on a TYPO3 site using femanager with admin-approval enabled, placing their account in the pending-approval queue. They then call the public resend-confirmation action to retrieve their own user confirmation hash, and submit that hash to the admin-approval endpoint instead of awaiting an admin-issued token. The endpoint accepts the hash, self-approves the account, and the attacker gains full access to content or features gated behind the admin-approval workflow. No public exploit code has been identified, but the steps are directly derivable from the CVE description.