Executive brief
The femanager extension for TYPO3 (a PHP-based web content management system) contains a flaw in its user invitation handling. An attacker can exploit this to take over any existing frontend user account by setting a new password and re-enabling the account, even without authentication. This allows unauthorized access to user accounts and potentially sensitive personal data stored in the CMS.
Technical details
The vulnerability is a broken access control issue (CWE-862) in the invitation controller of the femanager extension. The controller fails to halt processing after redirecting users with invalid input (missing hash, non-existent, disabled, or deleted user records), allowing an unauthenticated attacker to reach password reset functionality for arbitrary accounts. The attack vector is network-based with no authentication required, and the controller does not properly validate that the invitation process should terminate after error conditions. Versions 8.0.0 through 8.4.1 are affected; patched versions 8.4.2 and above are available.
Affected products
- in2code femanager 8.0.0 - 8.4.1
Timeline
- 2026-08-25: disclosed