What is CVE-2025-7900?

CVE-2025-7900 is a medium-severity vulnerability in Typo3 Extension "Femanager", classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2025-07-22.

How severe is CVE-2025-7900?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Typo3 Extension "Femanager"

CVE-2025-7900

The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.002 (11.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Typo3 Extension "Femanager" — versions 8.0.0, 7.0.0, 0
Typo3

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

f4fb688c-4412-4426-b4b8-421ecf27b14a (Vendor Advisory)

Frequently asked questions

What is CVE-2025-7900?: CVE-2025-7900 is a medium-severity vulnerability in Typo3 Extension "Femanager", classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2025-07-22.
How severe is CVE-2025-7900?: Medium severity. CVSS v3 base score is 6.5 out of 10.