The TYPO3 extension "femanager" contains an authorization bypass vulnerability (CWE-639) where the user detail view fails to verify that the requested user record corresponds to the authenticated or intended user. As a result, an unauthenticated or unauthorized visitor can supply arbitrary user IDs to access other frontend users' profile data, including personally identifiable information. This affects multiple versions of the extension, including 7.0.0, 8.0.0, 13.0.0, and all versions prior to 6.4.5, as well as specific version ranges before fixed versions. The CVSS 4.0 base score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

An attacker can access sensitive personal information of other frontend users without authorization, including names, email addresses, dates of birth, and physical addresses. This breach of confidentiality can lead to privacy violations and potential further attacks leveraging exposed user data. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict access to the Detail and List plugins to trusted users only or disable these plugins if possible to prevent unauthorized data exposure.