in2code-de/femanager · Security
Femanager extension for TYPO3 allows Insecure Direct Object Reference
- GHSA ID
- GHSA-rc5f-3hfv-jxp2
- CVE ID
- CVE-2025-7900
- Severity
- medium
- Published
- Updated
- CVSS v4
- 5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Description
The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0.
CWEs
- CWE-639 · Authorization Bypass Through User-Controlled Key