The TYPO3 extension "femanager" fails to enforce the use of a dedicated admin confirmation token when processing admin-approval requests. Instead, it accepts a regular user confirmation hash, which any visitor can obtain via the public resend-confirmation action. This flaw enables an attacker to self-approve accounts pending admin approval, effectively bypassing the authorization intended to restrict this action to administrators. The vulnerability is tracked as CWE-863 (Incorrect Authorization) and affects multiple versions of the extension, including 7.0.0, 8.0.0, 13.0.0, and ranges up to but excluding fixed versions 7.5.5, 8.4.2, and 13.3.5, as well as versions below 6.4.5. The CVSS 4.0 base score is 8.3, indicating high severity with network attack vector, low attack complexity, and no privileges or user interaction required.

An attacker can bypass the intended admin approval process for user accounts by exploiting this vulnerability, allowing self-approval of accounts that should require administrator confirmation. This could lead to unauthorized account activations and potential privilege escalation or unauthorized access within the TYPO3 system using the femanager extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is released, administrators should consider restricting access to the resend-confirmation action or implementing additional manual verification steps for account approvals to mitigate unauthorized self-approval.