TYPO3 Extension "Femanager"
5 CVEs affecting TYPO3 Extension "Femanager". Latest disclosed: 2026-08-25. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-7900 | Medium | 6.5 | 2025-07-22 | The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager vers… |
CVE-2026-77146 | | 2026-08-25 | The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), all… | |
CVE-2026-77135 | | 2026-08-25 | The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to t… | |
CVE-2026-77134 | | 2026-08-25 | The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainabl… | |
CVE-2026-77133 | | 2026-08-25 | The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field… |