CVE-2026-77134: CWE-863 Incorrect Authorization in TYPO3 Extension "femanager"

The TYPO3 extension "femanager" fails to enforce the use of a dedicated admin confirmation token when processing admin-approval requests. Instead, it accepts a regular user confirmation hash, which any visitor can obtain via the public resend-confirmation action. This allows an attacker to self-approve accounts pending admin approval, effectively bypassing the authorization control intended to restrict this action to administrators.

An attacker can escalate privileges by self-approving accounts that should require administrative approval. This could lead to unauthorized access or actions within the TYPO3 system where the extension is used. The vulnerability has a CVSS 4.0 score of 8.3, indicating high severity with network attack vector, low attack complexity, and no required privileges or user interaction.

No official patch or remediation level is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting access to the resend-confirmation action or implement additional access controls to prevent unauthorized self-approval.