CVE-2026-77135: CWE-639 Authorization Bypass Through User-Controlled Key in TYPO3 Extension "femanager"

The TYPO3 extension "femanager" contains an authorization bypass vulnerability (CWE-639) where the user detail view fails to verify that the requested user record corresponds to the authenticated or intended user. As a result, an unauthenticated or unauthorized visitor can access arbitrary frontend user profiles by providing arbitrary user IDs to the Detail or List plugin. This exposes sensitive user data including names, emails, dates of birth, and addresses. The vulnerability affects multiple versions of the extension, including versions 7.0.0 through before 7.5.5, 8.0.0 through before 8.4.2, and 13.0.0 through before 13.3.5, as well as all versions below 6.4.5. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker can retrieve sensitive personal information of arbitrary frontend users without authentication or proper authorization. This compromises user privacy and may facilitate further attacks such as social engineering or identity theft. The vulnerability does not require user interaction or privileges and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Detail and List plugins to trusted users only or disable these plugins if possible. Monitor TYPO3 and the femanager extension's official channels for updates and apply patches promptly once released.