Read the docs
TI-2026-53889 Aliases CVE-2026-77146GHSA-ccrq-xx5g-x98r

Broken Access Control in extension "femanager" (femanager)

Priority LOW 36CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is only present in the 8.x versions of the extension.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00419 36th percentileScored 2026-11-07
Fix Fixed Extension "femanager" (TYPO3): 8.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TYPO3Extension "femanager"8.0.0 to before 8.4.28.4.2Patch availableCNA
  • Extension "femanager" VendorTYPO3 Affected 8.0.0 to before 8.4.2 Fixed in 8.4.2 Patch available CNA

Remediation

  • Fix · CNA Extension "femanager" (TYPO3) Fixed in 8.4.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TYPO3 Extension "femanager" — typo3.org/security/advisory/typo3-ext-sa-2026-024

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-53877 Broken Access Control in extension "femanager" (femanager)Priority MEDIUM 42
    • TI-2026-53878 Information Disclosure in extension "femanager" (femanager)Priority LOW 36
    • TI-2026-53876 Broken Access Control in extension "femanager" (femanager)Priority LOW 29
    Show all 4 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77146
  2. 2026-10-03 Alias added: GHSA-ccrq-xx5g-x98r

References

Advisory 1

  • TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
  • TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
  • TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
  • TI-2025-30547 The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. CVSS 3.1CRITICAL 10.0
  • TI-2019-08867 The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before… CVSS 3.1CRITICAL 9.8
  • TI-2008-04019 Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before… CVSS 2.0HIGH 10.0
See all 411 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences