Description

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-14T07:17:15.353Z",
  "pubdate": "2026-09-14T07:17:15.353Z",
  "executiveSummary": "The femanager extension for TYPO3 contains a critical access control vulnerability affecting versions 7.x before 7.2.3. This flaw is categorized as an Improper Authorization vulnerability, arising from the extension's failure to adequately validate user permissions within the edit user component. By bypassing established access controls, an authenticated frontend user can perform unauthorized administrative actions against other users. The security impact is severe, allowing an attacker to modify sensitive personal data or permanently delete arbitrary frontend user accounts without holding necessary administrative privileges. The vulnerability represents a significant risk to data integrity and account availability within the TYPO3 ecosystem. Successful exploitation requires an active frontend user account, but does not necessitate elevated backend privileges, making it a viable vector for lateral movement or data sabotage by malicious registered users.",
  "technicalDetails": "The vulnerability resides within the edit user component of the femanager extension, a component responsible for managing frontend user profile updates and account lifecycle operations. The root cause is an insecure implementation of access control checks during the request handling process for user profile modifications and deletions. Specifically, the extension logic fails to verify if the authenticated user has the requisite authorization to modify or delete the user record specified in the request parameters.\nThe exploitation process is straightforward and does not require complex payloads. An authenticated user can identify the API endpoint or controller action associated with the edit user component. By manipulating the request—typically by altering user IDs (UIDs) within the query parameters or POST data—the attacker can target accounts other than their own. Since the underlying code fails to enforce a relationship validation between the currently logged-in user session and the target resource (the user profile ID being acted upon), the backend application processes the request as if it were authorized.\nThe attack flow follows these steps: 1) The attacker authenticates to the TYPO3 frontend via a legitimate, low-privileged user account. 2) The attacker interacts with the femanager profile management interface. 3) By intercepting the request or manually crafting a request targeting a different user's UID, the attacker submits an update or delete instruction. 4) The server-side application processes the malicious request without validating ownership or administrative permission status. 5) The femanager component executes the database operations, resulting in unauthorized data modification or account deletion.\nThis vulnerability is restricted to versions 7.x prior to 7.2.3. Because the vulnerable component is exposed via the frontend, the attack vector is network-based and accessible to any authenticated user. The impact post-exploitation includes unauthorized disclosure or alteration of PII, denial of service (via account deletion), and potential identity takeover if the attacker successfully alters profile credentials. There are no complex constraints on the attack; the lack of object-level authorization is a fundamental flaw in the component's access control logic."
}