GitHub Advisoryadvisory · Packagist

GHSA-rc5f-3hfv-jxp2 Femanager extension for TYPO3 allows Insecure Direct Object Reference

MEDIUM Published 2025-07-22 Modified 2025-07-22 Official page ↗
Aliases
CVE-2025-7900
Ecosystem
Packagist
Packages
in2code/femanager
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-639
Reviewed
2025-07-22

Affected packages

• Packagist in2code/femanager: < 6.4.2 → fixed in 6.4.2 • Packagist in2code/femanager: >= 7.0.0, < 7.5.3 → fixed in 7.5.3 • Packagist in2code/femanager: >= 8.0.0, < 8.3.1 → fixed in 8.3.1

Description

The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0.

Related

Alias · CVE (1)

  • CVE-2025-7900 The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References