Extension Femanager
Monthly
Self-service privilege escalation in the TYPO3 femanager (Frontend User Manager) extension allows any authenticated frontend user to assign themselves to arbitrary frontend usergroups via the profile edit plugin when operating under its default field configuration. The root cause is CWE-862 (Missing Authorization): the extension does not validate whether the requesting user is permitted to join the target group before processing the self-update. No public exploit has been identified at time of analysis, but the exploit path is straightforward for any logged-in frontend user on an affected TYPO3 installation. The CVSS 4.0 score of 6.0 reflects the prerequisite of an authenticated session and a specific configuration context.
The femanager extension for TYPO3 CMS incorrectly accepts a regular user confirmation hash - obtainable by any visitor via the public resend-confirmation action - in place of the privileged admin confirmation token when processing account-approval requests. This allows a registrant whose account is pending administrator authorization to self-approve that account, fully bypassing the admin-approval gate. No public exploit code has been identified at time of analysis, but the attack is mechanically trivial given the public exposure of the prerequisite token; the CVSS 4.0 score of 8.3 reflects high confidentiality impact against the vulnerable system.
Insecure Direct Object Reference in the TYPO3 femanager extension exposes frontend user profile data - including name, email address, date of birth, and postal address - to any unauthenticated visitor who can reach the Detail or List plugin. The extension's user detail view accepts a caller-supplied user ID without validating that the requested record belongs to the configured or authenticated target, making horizontal privilege escalation trivial via ID enumeration. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated account takeover in the TYPO3 femanager extension 8.x allows a remote attacker to reset the password of and re-enable any existing frontend user account - including disabled or deleted ones - by exploiting an invitation controller that continues processing after issuing a redirect on invalid input. No prior authentication or user interaction is required. No public exploit code or active exploitation has been identified at time of analysis, but the impact is severe: full account takeover of arbitrary frontend users in any TYPO3 installation running femanager 8.x.
Self-service privilege escalation in the TYPO3 femanager (Frontend User Manager) extension allows any authenticated frontend user to assign themselves to arbitrary frontend usergroups via the profile edit plugin when operating under its default field configuration. The root cause is CWE-862 (Missing Authorization): the extension does not validate whether the requesting user is permitted to join the target group before processing the self-update. No public exploit has been identified at time of analysis, but the exploit path is straightforward for any logged-in frontend user on an affected TYPO3 installation. The CVSS 4.0 score of 6.0 reflects the prerequisite of an authenticated session and a specific configuration context.
The femanager extension for TYPO3 CMS incorrectly accepts a regular user confirmation hash - obtainable by any visitor via the public resend-confirmation action - in place of the privileged admin confirmation token when processing account-approval requests. This allows a registrant whose account is pending administrator authorization to self-approve that account, fully bypassing the admin-approval gate. No public exploit code has been identified at time of analysis, but the attack is mechanically trivial given the public exposure of the prerequisite token; the CVSS 4.0 score of 8.3 reflects high confidentiality impact against the vulnerable system.
Insecure Direct Object Reference in the TYPO3 femanager extension exposes frontend user profile data - including name, email address, date of birth, and postal address - to any unauthenticated visitor who can reach the Detail or List plugin. The extension's user detail view accepts a caller-supplied user ID without validating that the requested record belongs to the configured or authenticated target, making horizontal privilege escalation trivial via ID enumeration. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated account takeover in the TYPO3 femanager extension 8.x allows a remote attacker to reset the password of and re-enable any existing frontend user account - including disabled or deleted ones - by exploiting an invitation controller that continues processing after issuing a redirect on invalid input. No prior authentication or user interaction is required. No public exploit code or active exploitation has been identified at time of analysis, but the impact is severe: full account takeover of arbitrary frontend users in any TYPO3 installation running femanager 8.x.