CVE-2023-50460

Deferred Deferred - Pending Action

Authentication Bypass in Femanager TYPO3 Extension

Publication date: 2026-09-14

Last updated on: 2026-09-22

Assigner: MITRE

Description

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions (userLogout, confirmUser, refuseUser, and resendUserConfirmation) for any frontend user in the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-22

Generated

2026-10-04

AI Q&A

2026-09-14

EPSS Evaluated

2026-10-03

NVD

CVE-2023-50460

EUVD

EUVD-2023-60686

Affected Vendors & Products

Vendor	Product	Version / Range
typo3	femanager	to 7.2.2 (inc)
typo3	femanager	7.2.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is in the femanager extension for TYPO3. It allows an authenticated backend user to perform actions like logging out, confirming, refusing, or resending confirmation for any frontend user in the system.

Detection Guidance

To detect this vulnerability, check the version of the femanager extension in your TYPO3 installation. If the version is between 7.0.0 and 7.2.2, the system is vulnerable. Use the TYPO3 Install Tool or backend module to verify the installed version.

Impact Analysis

An attacker with backend access could manipulate frontend user accounts, causing disruptions like unauthorized logouts or preventing legitimate users from accessing the system.

Compliance Impact

This vulnerability could lead to unauthorized access or disruption of user accounts, potentially violating data integrity and access control requirements in GDPR or HIPAA.

Mitigation Strategies

Update the femanager extension to version 7.2.3 or later to address the vulnerability. Remove unnecessary permissions for backend users to prevent unauthorized actions on frontend users.

Hi! I’m here to help you understand CVE-2023-50460. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70