Skip to content
CVE PROGRAM SOURCE RECORD6.0 Medium

CVE-2026-77133

Broken Access Control in extension "femanager" (femanager)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TYPO3

Description

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TYPO3 Extension "femanager"

Default version status: unaffected

  • 13.0.0 to < 13.3.5affected
  • 8.0.0 to < 8.4.2affected
  • 7.0.0 to < 7.5.5affected
  • 0 to < 6.4.5affected

References