CVE-2026-77135

HighCVSS 8.2/10Last modified Sep 28, 2026

Description

The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying an arbitrary user ID.

Metrics

CVSS 4.0 8.2/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
TYPO3	Extension "femanager"	>= 13.0.0, < 13.3.5; >= 8.0.0, < 8.4.2; >= 7.0.0, < 7.5.5; < 6.4.5

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-024

Timeline

Published: Aug 25, 2026
Last modified: Sep 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-771369.5The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as CVE-2026-771377.7The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inje CVE-2026-771389.3The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, una CVE-2026-771396.0The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask temp CVE-2026-77146.5A flaw has been found in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this issue is some unknown functionality of the file CVE-2026-771408.7The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that pers CVE-2026-771418.8The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, bu CVE-2026-771428.8The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a vis CVE-2026-771438.8The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a CVE-2026-771447.1The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no CVE-2026-771457.1The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user w CVE-2026-771468.3The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or