CVE-2026-77133: falha de média gravidade em TYPO3 Extension "femanager"
Broken Access Control in extension "femanager" (femanager)
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6epss 0.4%
The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
TYPO3 · Extension "femanager"CVEs relacionadas — TYPO3 Extension "femanager"
No mesmo produto, das mais perigosas para as menos.
CVE-2026-77146HIGHBroken Access Control in extension "femanager" (femanager)EPSS 0.4%CVE-2026-77134HIGHBroken Access Control in extension "femanager" (femanager)EPSS 0.4%CVE-2026-77135HIGHInformation Disclosure in extension "femanager" (femanager)EPSS 0.4%CVE-2025-7900MEDIUMInsecure Direct Object Reference in extension "femanager" (femanager)EPSS 0.3%