CVE-2026-77133 Broken Access Control in extension "femanager" (femanager)

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

CVE-2026-77133

CVE-2026-77133 is a broken access control vulnerability in the TYPO3 extension femanager . When the profile edit plugin uses its default field configuration, it fails to restrict which frontend usergroups a logged-in user may assign to their own account, enabling self-service privilege escalation...

CVE-2026-77135 Information Disclosure in extension "femanager" (femanager)

The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying ...

CVE-2026-77134

CVE-2026-77134 is a Broken Access Control vulnerability in the TYPO3 extension femanager . The extension fails to require the dedicated admin confirmation token when processing an admin-approval request. Instead, a regular user confirmation hash—obtainable by any visitor through the public resend...

CVE-2026-77135

CVE-2026-77135 is an information disclosure vulnerability in the TYPO3 extension femanager . The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another ...

CVE-2026-77134 Broken Access Control in extension "femanager" (femanager)

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval...

CVE-2026-77146

CVE-2026-77146 affects the TYPO3 extension femanager (version 8.x ). The invitation controller fails to stop processing after redirecting on invalid input — specifically missing hash, non-existent, disabled, or deleted users — allowing an unauthenticated attacker to set a new password for and re-...

TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024...

TYPO3-EXT-SA-2026-024: Information Disclosure in extension "femanager" (femanager)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024...

TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024...

TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024...

CVE-2023-25014

An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to delete all frontend users...

CVE-2023-25013

An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to set the password of all frontend users...

EUVD-2021-2048

Malware in sbrugna...

EUVD-2014-6177

Malware in sbrugna...

EUVD-2025-22305

Malicious code in bioql PyPI...

EUVD-2023-0614

Malicious code in bioql PyPI...

EUVD-2023-0740

Malicious code in bioql PyPI...

EUVD-2025-16028

Malicious code in bioql PyPI...

Insecure Direct Object Reference (IDOR)

in2code/femanager is vulnerable to Insecure Direct Object Reference IDOR. The vulnerability is due to insufficient access control due to direct access to user data objects without proper authorization checks, allowing unauthorized modification of user data...