CVE-2025-7900 - Insecure Direct Object Reference in extension "femanager" (femanager)

Back Back to CVE browser

MEDIUM

Insecure Direct Object Reference in extension "femanager" (femanager)

Published Jul 22, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.21%

Description

The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0

Affected products

Vendor TYPO3 Product Extension "femanager" Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=6.4.1
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.5.2
- Version
  8.0.0
  Status
  affected
  Constraints
  <=8.3.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

TYPO3

Extension "femanager"

unaffected

Version	Status	Constraints
0	affected	<=6.4.1
7.0.0	affected	<=7.5.2
8.0.0	affected	<=8.3.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-639

Authorization Bypass

References (5)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-22305		Advisory
https://github.com/advisories/GHSA-rc5f-3hfv-jxp2		Advisory
https://github.com/in2code-de/femanager/commit/9bd9fbded4cf31f69bfe03c55d406e79050f8069
https://nvd.nist.gov/vuln/detail/CVE-2025-7900
https://typo3.org/security/advisory/typo3-ext-sa-2025-010		Vendor Advisory