Description

The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-14T06:16:54.207Z",
  "pubdate": "2026-09-14T06:16:54.207Z",
  "executiveSummary": "The femanager extension for TYPO3, specifically versions prior to 7.2.2, contains a critical security vulnerability categorized as Incorrect Access Control.\nThis flaw resides within the invitation component of the extension, where the software fails to enforce necessary permission checks before allowing access to sensitive functionality.\nThe vulnerability allows an unauthorized actor to interact with the invitation mechanism, potentially bypassing security constraints intended to restrict these operations to authorized users or administrative roles.\nThe impact includes unauthorized manipulation or exposure of invitation data, which could lead to unauthorized user onboarding or the compromising of user registration flows within the TYPO3 environment.\nThe risk implication is significant as it undermines the integrity of the user management process. Exploitation requires the attacker to have network access to the target TYPO3 instance but does not necessarily require prior authentication or elevated privileges, depending on the specific implementation of the invitation endpoint.\nOrganizations using affected versions of femanager are exposed to these risks until the software is updated to the patched version.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the access control logic within the invitation component of the femanager extension. Specifically, the component lacks explicit authorization checks to verify if the requesting user possesses the requisite privileges to invoke or interact with invitation-related functions.\nIn the TYPO3 architecture, extensions are responsible for validating the identity and permissions of a requestor before executing controller actions that alter state or disclose sensitive information. In versions of femanager prior to 7.2.2, the invitation component does not properly perform these checks during the request lifecycle.\nThe attack flow typically begins with an attacker identifying the endpoint responsible for the invitation mechanism within the femanager extension. By crafting a specific request targeting this endpoint, the attacker can interact with the component directly.\nBecause the necessary permission checks are omitted, the application processes these requests regardless of the user's current session status or assigned roles. An unauthenticated or low-privileged user can successfully trigger actions that are meant to be restricted.\nThis behavior constitutes an Improper Access Control vulnerability. The impact extends beyond mere unauthorized access; if the invitation mechanism allows for the creation, modification, or deletion of invitation records, an attacker might be able to intercept or influence the registration process. Furthermore, if the component leaks information about existing invitations or related user data, it may lead to further reconnaissance and potential lateral movement within the application's user database.\nThis vulnerability is present in all versions of the femanager extension earlier than 7.2.2. The lack of validation occurs at the server-side controller level, meaning that client-side restrictions or obscured URLs are insufficient to prevent exploitation. Attackers do not need specialized tools, as standard HTTP request manipulation is sufficient to interact with the improperly secured endpoints. Once exploited, the attacker effectively bypasses the business logic constraints established for user management, potentially leading to unauthorized onboarding or account takeover scenarios depending on the specific configuration of the invitation workflow."
}