# CVE-2026-77134: in2code femanager authentication bypass in admin approval

Source: https://junglewise.ai/threats/cve-2026-77134-in2code-femanager-authentication-bypass-in-admin-approval  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77134 · Severity: info · CVSS 7.5 · Published 2026-08-25

The femanager extension for TYPO3 fails to properly validate admin approval requests for new user accounts. An attacker can obtain a standard user confirmation token through a public action and use it to self-approve their own account even when admin approval is required, bypassing the intended account creation workflow and gaining unauthorized access.

Technologies: [In2code Femanager](https://junglewise.ai/threats/technologies/femanager). Vendors: [In2code](https://junglewise.ai/threats/vendors/in2code).

## Quick answers

**Is CVE-2026-77134 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77134 being exploited in the wild.

**How severe is CVE-2026-77134?** Informational severity, with a CVSS score of 7.5, published 25 August 2026.

**Which products and versions are affected?** In2code Femanager 6.4.4 and below, 7.0.0-7.5.4, 8.0.0-8.4.1, 13.0.0-13.3.4.

**Is there a fix for CVE-2026-77134?** A patch was published on 2026-08-25: Fixes available in versions 6.4.5, 7.5.5, 8.4.2, 13.3.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77134 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77134?** Check whether you run In2code Femanager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control flaw (CWE-862, CWE-863) in the femanager extension's admin-approval request processing. The extension accepts a standard user confirmation hash—obtainable by any unauthenticated visitor through the public resend-confirmation action—as sufficient authorization to approve a pending user account, instead of requiring a dedicated admin confirmation token. An attacker can leverage this to self-approve their account without legitimate admin authorization, resulting in unauthorized account activation and potential privilege escalation. Network reachable; no authentication required. Patches available in versions 6.4.5, 7.5.5, 8.4.2, and 13.3.5.

## Affected products

- in2code femanager 6.4.4 and below, 7.0.0-7.5.4, 8.0.0-8.4.1, 13.0.0-13.3.4

## Timeline

- 2026-08-25: disclosed
- 2026-08-25: patched: Fixes available in versions 6.4.5, 7.5.5, 8.4.2, 13.3.5

## References

- [https://packagist.org/](https://packagist.org/)
- [https://typo3.org/security/advisory/typo3-ext-sa-2026-024](https://typo3.org/security/advisory/typo3-ext-sa-2026-024)

## Related threats

- [TYPO3 femanager broken access control in edit user component](https://junglewise.ai/threats/cve-2023-50459-typo3-femanager-broken-access-control-in-edit-user-component)
- [in2code femanager broken access control in invitation component](https://junglewise.ai/threats/cve-2023-45023-in2code-femanager-broken-access-control-in-invitation-component)
- [TYPO3 femanager account takeover via invitation controller](https://junglewise.ai/threats/cve-2026-77146-typo3-femanager-account-takeover-via-invitation-controller)
- [in2code femanager broken access control in user detail view](https://junglewise.ai/threats/cve-2026-77135-in2code-femanager-broken-access-control-in-user-detail-view)
- [in2code femanager privilege escalation in profile edit](https://junglewise.ai/threats/cve-2026-77133-in2code-femanager-privilege-escalation-in-profile-edit)