CVE-2023-25014

HIGH

femanager < 5.5.3, 6.x < 6.3.4, 7.x < 7.1.0 - Unauthenticated Frontend User Deletion via InvitationController

Title source: llm

Description

An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to delete all frontend users.

References (2)

Core 2

Core References

Third Party Advisory

https://typo3.org/help/security-advisories

Patch, Third Party Advisory

https://typo3.org/security/advisory/typo3-ext-sa-2023-001

Scores

CVSS v3 8.6

EPSS 0.0050

EPSS Percentile 38.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-306 CWE-862

Status published

Products (2)

in2code/femanager < 5.5.3

in2code/femanager 0 - 5.5.3Packagist

Published Feb 02, 2023

Tracked Since Feb 18, 2026