CVE-2026-77133
Received Received - Intake

Privilege Escalation in Profile Edit Plugin via Usergroup Assignment

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: TYPO3

Description
The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-77133
EUVD
EUVD-2026-65343

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
in2code femanager to 6.5 (exc)
in2code femanager From 7.0 (inc) to 7.5.5 (exc)
in2code femanager From 8.0 (inc) to 8.4.2 (exc)
in2code femanager From 13.0 (inc) to 13.3.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows a logged-in user to escalate their own privileges by assigning themselves to arbitrary frontend user groups through the profile edit plugin's default field configuration. The extension fails to properly restrict which groups can be selected during self-service account edits.

Detection Guidance

To detect this vulnerability, check if the femanager extension is installed and its version is below the patched versions (6.4.5, 7.5.5, 8.4.2, or 13.3.5). Inspect the frontend user group assignment logic in the profile edit plugin for improper restrictions.

Impact Analysis

An attacker with basic access could gain elevated permissions without needing additional credentials. This could allow unauthorized access to sensitive features or data restricted to higher-privilege groups.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating principles of least privilege and data protection requirements in GDPR and HIPAA. It may result in compliance violations and potential legal consequences.

Mitigation Strategies

Review and restrict usergroup assignment permissions in the profile edit plugin configuration. Disable self-service group assignment if not required. Update to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77133. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart