The TYPO3 extension "femanager" contains a missing authorization control (CWE-862) that fails to restrict which frontend user groups a logged-in user can assign to their own account. When the profile edit plugin is configured with default fields, this allows self-service privilege escalation by enabling users to add themselves to arbitrary frontend groups. The vulnerability affects versions =13.0.0, =8.0.0, =7.0.0, >=13.0.0 <13.3.5, >=8.0.0 <8.4.2, >=7.0.0 <7.5.5, and <6.4.5. The CVSS 4.0 vector indicates network attack vector, low attack complexity, privileges required are low, no user interaction needed, and high impact on confidentiality with limited impact on integrity and availability. No vendor advisory or patch links are currently available.

Exploitation of this vulnerability allows a logged-in frontend user to escalate their privileges by assigning themselves to arbitrary frontend user groups. This can lead to unauthorized access to restricted resources or functionality within the TYPO3 site. The impact on confidentiality is high, while integrity and availability impacts are limited. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting access to the profile edit plugin or customizing its configuration to prevent users from modifying their frontend user group assignments.