Read the docs
TI-2026-53876 Aliases CVE-2026-77133GHSA-qjph-66v6-w5fp

Broken Access Control in extension "femanager" (femanager)

Priority LOW 29CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00351 28th percentileScored 2026-11-07
Fix Fixed Extension "femanager" (TYPO3): 13.3.5, 8.4.2, 7.5.5 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TYPO3Extension "femanager"13.0.0 to before 13.3.5; 8.0.0 to before 8.4.2; 7.0.0 to before 7.5.5; before 6.4.513.3.5, 8.4.2, 7.5.5, 6.4.5Patch availableCNA
  • Extension "femanager" VendorTYPO3 Affected 13.0.0 to before 13.3.5; 8.0.0 to before 8.4.2; 7.0.0 to before 7.5.5; before 6.4.5 Fixed in 13.3.5, 8.4.2, 7.5.5, 6.4.5 Patch available CNA

Remediation

  • Fix · CNA Extension "femanager" (TYPO3) Fixed in 13.3.5, 8.4.2, 7.5.5, 6.4.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TYPO3 Extension "femanager" — typo3.org/security/advisory/typo3-ext-sa-2026-024

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-53877 Broken Access Control in extension "femanager" (femanager)Priority MEDIUM 42
    • TI-2026-53889 Broken Access Control in extension "femanager" (femanager)Priority LOW 36
    • TI-2026-53878 Information Disclosure in extension "femanager" (femanager)Priority LOW 36
    Show all 4 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77133
  2. 2026-10-03 Alias added: GHSA-qjph-66v6-w5fp

References

Advisory 1

  • TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
  • TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
  • TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
  • TI-2025-30547 The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. CVSS 3.1CRITICAL 10.0
  • TI-2019-08867 The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before… CVSS 3.1CRITICAL 9.8
  • TI-2008-04019 Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before… CVSS 2.0HIGH 10.0
See all 411 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences