Listen to this Post
The CVE-2025-XXXX vulnerability in the femanager extension for TYPO3 arises due to improper access control checks when handling user data modifications. The flaw allows attackers to manipulate object references directly, bypassing authorization mechanisms. By crafting malicious requests, an attacker can modify sensitive user data without proper validation. The vulnerability stems from insufficient validation of user-supplied input in the backend controllers, enabling IDOR (Insecure Direct Object Reference). Affected versions include femanager 6.4.1 and prior, 7.0.0 to 7.5.2, and 8.0.0 to 8.3.0.
DailyCVE Form:
Platform: TYPO3
Version: <6.4.2, 7.0.0-7.5.2, 8.0.0-8.3.0
Vulnerability: IDOR
Severity: Moderate
Date: Jul 22, 2025
Prediction: Patch by Aug 15, 2025
What Undercode Say:
Check installed femanager version composer show in2code/femanager Verify TYPO3 core version typo3/cms-core --version Mitigation workaround (before patch) Disable femanager user editing via TSconfig: mod.web_list.deniedEditTables := addToList(fe_users)
How Exploit:
- Craft POST request to `/typo3/femanager/edit` with manipulated
userUid. - Bypass CSRF checks via session fixation.
- Modify sensitive user fields (e.g., email, password).
Protection from this CVE:
- Upgrade to femanager 6.4.2, 7.5.3, or 8.3.1.
- Implement proper access controls.
- Validate user references server-side.
Impact:
- Unauthorized data modification.
- Potential account takeover.
- Data integrity compromise.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
