CVE-2025-7900

Insecure Direct Object Reference in extension "femanager" (femanager)

State: Published
Severity: 5.3 Medium
Published: Jul 22, 2025
Updated: Jul 22, 2025
Reserved: Jul 19, 2025

Description

The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	TYPO3

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
Extension "femanager"TYPO3	8.0.0 through 8.3.0Affected 7.0.0 through 7.5.2Affected 6.4.1 and earlierAffected

References

https://typo3.org/security/advisory/typo3-ext-sa-2025-010

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.