Description

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions (userLogout, confirmUser, refuseUser, and resendUserConfirmation) for any frontend user in the system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-14T07:17:15.510Z",
  "pubdate": "2026-09-14T07:17:15.510Z",
  "executiveSummary": "An improper access control vulnerability exists in the femanager extension for TYPO3, specifically affecting versions 7.x prior to 7.2.3. This vulnerability allows an authenticated backend user to perform unauthorized administrative actions on arbitrary frontend users.\nThe flaw stems from insufficient authorization checks within the extension's backend module functions, which fail to validate whether the current user has the appropriate permissions to manipulate the targeted account.\nImpacts include unauthorized user management, such as forcing logouts, confirming, refusing, or triggering confirmation emails for any frontend user within the TYPO3 system. This represents a significant risk to user integrity and privacy, potentially leading to unauthorized account state changes.\nExploitation requires the attacker to possess a valid, authenticated TYPO3 backend user account. No special frontend access is required, as the vector originates entirely from within the backend administrative interface.",
  "technicalDetails": "The vulnerability resides within the backend management module of the femanager extension, a component responsible for facilitating frontend user administration tasks. The root cause is a failure in the application logic to perform adequate authorization checks (access control lists or ownership verification) before executing sensitive administrative functions.\nSpecifically, the backend module exposes several methods—userLogout, confirmUser, refuseUser, and resendUserConfirmation—that act upon user identifiers provided as input parameters. Due to the lack of server-side validation against the requesting user's identity or authorization scope, the backend module executes these functions for any user ID supplied in the request.\nThe attack flow proceeds as follows: 1) An attacker authenticates to the TYPO3 backend with valid credentials. 2) The attacker navigates to the femanager backend module. 3) The attacker identifies a target frontend user and extracts their unique identifier (UID). 4) By intercepting the request or manipulating the interface, the attacker invokes one of the vulnerable methods (e.g., userLogout or confirmUser) while substituting the target's UID.\nBecause the extension does not check if the current backend session is authorized to modify the target frontend user, the underlying service layer processes the command as a legitimate administrative action. This allows for arbitrary state changes, such as disabling a user account via refuseUser or manually validating an account via confirmUser, even if the backend user lacks the necessary administrative permissions to perform such actions globally.\nThis vulnerability is classified as an Improper Access Control flaw within the backend administration logic. The affected versions are limited to the 7.x branch prior to 7.2.3. Post-exploitation impact is primarily confined to unauthorized management of frontend accounts, which could be leveraged to disrupt user access, bypass registration workflows, or escalate administrative interference with user account lifecycles.\nAs the exploit vector exists exclusively within the authenticated backend environment, the exposure is limited to actors who have already successfully obtained backend access, highlighting the critical importance of restricting administrative access to the TYPO3 backend only to trusted individuals."
}