CVE-2026-77146

The extension's invitation controller fails to stop processing after redirecting on invalid input missing hash, non-existent, disabled, or deleted users, allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is...

EUVD-2026-65330

The extension's invitation controller fails to stop processing after redirecting on invalid input missing hash, non-existent, disabled, or deleted users, allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is...

CVE-2026-77146

CVE-2026-77146 affects the TYPO3 extension femanager (version 8.x ). The invitation controller fails to stop processing after redirecting on invalid input — specifically missing hash, non-existent, disabled, or deleted users — allowing an unauthenticated attacker to set a new password for and re-...

The vulnerability of the femanager extension of the TYPO3 content management system allows a hacker to remove arbitrary users.

The vulnerability of the femanager extension of the TYPO3 content management system is related to the lack of access control in the InvitationController function. Exploiting this vulnerability could allow a malicious actor to delete arbitrary users remotely...

TYPO3 访问控制错误漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. A security vulnerability exists in TYPO3 version 5.5.3, version 6.x up to and including version 6.3.4, and version 7.x up to and including version 7.1.0, which stems from a lack ...