CVE-2026-77146

The extension's invitation controller fails to stop processing after redirecting on invalid input missing hash, non-existent, disabled, or deleted users, allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is...

CVE-2026-77146 Broken Access Control in extension "femanager" (femanager)

The extension's invitation controller fails to stop processing after redirecting on invalid input missing hash, non-existent, disabled, or deleted users, allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is...

EUVD-2026-65330

The extension's invitation controller fails to stop processing after redirecting on invalid input missing hash, non-existent, disabled, or deleted users, allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is...

CVE-2026-77146 Broken Access Control in extension "femanager" (femanager)

The extension's invitation controller fails to stop processing after redirecting on invalid input missing hash, non-existent, disabled, or deleted users, allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is...

CVE-2026-77146 Broken Access Control in extension "femanager" (femanager)

The extension's invitation controller fails to stop processing after redirecting on invalid input missing hash, non-existent, disabled, or deleted users, allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is...

CVE-2026-77146

CVE-2026-77146 affects the TYPO3 extension femanager (version 8.x ). The invitation controller fails to stop processing after redirecting on invalid input — specifically missing hash, non-existent, disabled, or deleted users — allowing an unauthenticated attacker to set a new password for and re-...

CVE-2026-77146: Missing Authorization

The extension's invitation controller fails to stop processing after redirecting on invalid input missing hash, non-existent, disabled, or deleted users, allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is...

PT-2026-81246

Name of the Vulnerable Software and Affected Versions femanager versions 8.x Description The invitation controller fails to stop processing after redirecting when it encounters invalid input, such as a missing hash or users that are non-existent, disabled, or deleted. This allows an unauthenticat...

PT-2026-71997

Name of the Vulnerable Software and Affected Versions Grav Plugin API getgrav/grav-plugin-api versions prior to 1.0.13 Description An issue exists in the InvitationsController where API-key scope caps are not properly enforced. The system uses a basic isSuperAdmin check instead of a scope-aware...

The vulnerability of the femanager extension of the TYPO3 content management system allows a hacker to remove arbitrary users.

The vulnerability of the femanager extension of the TYPO3 content management system is related to the lack of access control in the InvitationController function. Exploiting this vulnerability could allow a malicious actor to delete arbitrary users remotely...

TYPO3 访问控制错误漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. A security vulnerability exists in TYPO3 version 5.5.3, version 6.x up to and including version 6.3.4, and version 7.x up to and including version 7.1.0, which stems from a lack ...