Veille CVE

Recherche « TYPO3 Extension "femanager" »

4 CVE

Critique 0 Élevée 3 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « TYPO3 Extension "femanager" » ✕
  1. CVE-2026-77146 8.3 Élevée

    TYPO3 Extension "femanager"

    The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is only present in the 8.x versions of the extension.

  2. CVE-2026-77135 8.2 Élevée

    TYPO3 Extension "femanager"

    The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying an arbitrary user ID.

  3. CVE-2026-77134 8.3 Élevée

    TYPO3 Extension "femanager"

    The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval.

  4. CVE-2026-77133 6.0 Moyenne

    TYPO3 Extension "femanager"

    The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.