Is CVE-2026-77146 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77146 being exploited in the wild.

How severe is CVE-2026-77146?

Informational severity, with a CVSS score of 8.1, published 25 August 2026.

Which products and versions are affected?

In2code Femanager 8.0.0 - 8.4.1.

Is there a fix for CVE-2026-77146?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-77146 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77146?

Check whether you run In2code Femanager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77146: TYPO3 femanager account takeover via invitation controller

CVE-2026-77146 · Severity: info · CVSS 8.1 · Published 2026-08-25

The femanager extension for TYPO3 (a PHP-based web content management system) contains a flaw in its user invitation handling. An attacker can exploit this to take over any existing frontend user account by setting a new password and re-enabling the account, even without authentication. This allows unauthorized access to user accounts and potentially sensitive personal data stored in the CMS.

Technologies: In2code Femanager. Vendors: In2code.

Quick answers

Is CVE-2026-77146 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77146 being exploited in the wild.
How severe is CVE-2026-77146?: Informational severity, with a CVSS score of 8.1, published 25 August 2026.
Which products and versions are affected?: In2code Femanager 8.0.0 - 8.4.1.
Is there a fix for CVE-2026-77146?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77146 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77146?: Check whether you run In2code Femanager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a broken access control issue (CWE-862) in the invitation controller of the femanager extension. The controller fails to halt processing after redirecting users with invalid input (missing hash, non-existent, disabled, or deleted user records), allowing an unauthenticated attacker to reach password reset functionality for arbitrary accounts. The attack vector is network-based with no authentication required, and the controller does not properly validate that the invitation process should terminate after error conditions. Versions 8.0.0 through 8.4.1 are affected; patched versions 8.4.2 and above are available.

Affected products

in2code femanager 8.0.0 - 8.4.1

Timeline

2026-08-25: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.