CVE-2026-77133: CWE-862 Missing Authorization in TYPO3 Extension "femanager"

CVE-2026-77133 is a missing authorization vulnerability (CWE-862) in the TYPO3 extension "femanager". The extension does not properly restrict which frontend user groups a logged-in user can assign to their own account when the profile edit plugin is configured with default fields. This flaw enables self-service privilege escalation by allowing users to assign themselves to arbitrary frontend groups. The issue affects versions >=0 <6.4.5, >=7.0.0 <7.5.5, >=8.0.0 <8.4.2, and >=13.0.0 <13.3.5 of the extension.

Exploitation of this vulnerability allows authenticated users to escalate their privileges by assigning themselves to frontend user groups they should not have access to. This can lead to unauthorized access to restricted functionality or data within TYPO3 sites using the affected extension versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Users should monitor TYPO3 vendor advisories for updates and apply any official fixes once available. Until then, consider restricting access to the profile edit plugin or customizing its configuration to prevent unauthorized group assignments.