Vulnerability · Published Aug 25, 2026 · Assigned by TYPO3

CVE-2026-77135Information Disclosure in extension "femanager" (femanager)

High 8.2

In plain English

A high-severity authorization bypass via user-controlled key in Extension "femanager" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.4%top 65.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying an arbitrary user ID.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	Extension "femanager"	13.0.0 – before 13.3.58.0.0 – before 8.4.27.0.0 – before 7.5.50 – before 6.4.5

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-024 vendor-advisory