TYPO3-EXT-SA-2026-024: Multiple vulnerabilities in extension "femanager" (femanager)

• Release Date: August 25, 2026
• Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
• Component: "femanager" (femanager)
• Composer Package Name: in2code/femanager
• Vulnerability Type: Broken Access Control, Information Disclosure
• Affected Versions: 6.4.4 and below, 7.0.0 - 7.5.4, 8.0.0 - 8.4.1, 13.0.0 - 13.3.4
• Severity: High
• Suggested CVSS v4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
• References: CVE-2026-77133, CVE-2026-77134, CVE-2026-77135, CVE-2026-77146, CWE-862, CWE-863, CWE-639

Problem Description

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups. (CVE-2026-77133)

The extension also fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval. (CVE-2026-77134)

The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying an arbitrary user ID. (CVE-2026-77135)

The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is only available in the 8.x versions of the extension. (CVE-2026-77146)

Solution

Updated versions 6.4.5, 7.5.5, 8.4.2 and 13.3.5 are available from the TYPO3 extension manager, packagist and at

https://extensions.typo3.org/extension/download/femanager/6.4.5/zip
https://extensions.typo3.org/extension/download/femanager/7.5.5/zip
https://extensions.typo3.org/extension/download/femanager/8.4.2/zip
https://extensions.typo3.org/extension/download/femanager/13.3.5/zip

Users of the extension are advised to update the extension as soon as possible.

Credits

Thanks to Arpit Jain for reporting CVE-2026-77135, to Seungbin Yang and Miguel Segovia Gil for reporting CVE-2026-77134, to Seungbin Yang for reporting CVE-2026-77133, to Steffen Keuper for reporting CVE-2026-77146, and to in2code for providing updated versions of the extension.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide.