CVE-2023-45023: TYPO3 Femanager Auth Bypass Vulnerability

CVE-2023-45023 Overview

CVE-2023-45023 is a missing authorization vulnerability in the femanager extension for TYPO3. Versions of femanager 7 prior to 7.2.2 fail to enforce permission checks on the invitation component. An authenticated attacker with low privileges can abuse the invitation functionality to perform actions they should not be authorized to execute. The flaw is classified as [CWE-863] Incorrect Authorization. TYPO3 published this issue as Security Advisory TYPO3-EXT-SA-2023-008.

Critical Impact
Authenticated users can bypass access controls on the femanager invitation component, resulting in limited confidentiality and integrity impact on affected TYPO3 installations.

Affected Products

TYPO3 femanager extension versions 7.0.0 through 7.2.1
TYPO3 sites using the femanager frontend user management extension
Fixed in femanager version 7.2.2

Discovery Timeline

2026-09-14 - CVE-2023-45023 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2023-45023

Vulnerability Analysis

The femanager extension provides frontend user management for TYPO3, including registration, editing, and invitation workflows. In versions before 7.2.2, the invitation component does not verify whether the requesting user holds the permissions required to invoke it. This gap allows a low-privileged authenticated user to reach code paths that should be restricted to administrative or explicitly authorized roles. The exploitation path is network-accessible but requires high attack complexity, which constrains real-world impact to specific configurations.

Root Cause

The root cause is a missing authorization check in the invitation handler of the femanager extension. The controller executes invitation logic without validating the caller's role or scope against the required permission set. [CWE-863] Incorrect Authorization describes this class of defect, where an application performs an authorization step that does not correctly restrict access.

Attack Vector

Exploitation requires network access to the affected TYPO3 site and a low-privileged authenticated session. The attacker sends a crafted request to the invitation component endpoint exposed by femanager. Because the extension does not check permissions before processing the request, the invitation action executes with the effective privileges of the component rather than those of the caller. No user interaction is required beyond the attacker's own request.

No verified public exploit code is available for this issue. Refer to the TYPO3 Security Advisory 2023-008 for the maintainer's technical description.

Detection Methods for CVE-2023-45023

Indicators of Compromise

Unexpected frontend user invitations recorded in the TYPO3 fe_users table or femanager logs
HTTP requests to femanager invitation endpoints originating from accounts that should not have invitation rights
New frontend user accounts created outside of documented administrative workflows

Detection Strategies

Audit femanager extension version across all TYPO3 instances and flag any deployment running a 7.x release earlier than 7.2.2
Correlate authenticated session identifiers with invitation actions to identify low-privileged accounts triggering privileged handlers
Review TYPO3 application logs for anomalous access patterns to the femanager invitation controller

Monitoring Recommendations

Enable and centralize TYPO3 access and application logs for the femanager extension
Alert on creation of new frontend users outside expected administrative sources or hours
Track configuration and version drift on TYPO3 extensions using an inventory or software composition tool

How to Mitigate CVE-2023-45023

Immediate Actions Required

Upgrade the femanager extension to version 7.2.2 or later on all affected TYPO3 sites
Review recently created frontend user accounts and revoke any that cannot be attributed to a legitimate invitation
Restrict access to TYPO3 frontend user management endpoints to trusted network segments where feasible

Patch Information

The maintainers resolved the vulnerability in femanager 7.2.2 by adding the missing permission check to the invitation component. Full details are published in the TYPO3 Security Advisory 2023-008. Administrators should update through the TYPO3 Extension Manager or Composer using the standard extension update workflow.

Workarounds

Disable the femanager invitation feature in TYPO3 configuration until the extension can be upgraded
Remove or restrict low-privileged frontend user roles that do not require access to the invitation workflow
Place the affected TYPO3 site behind a web application firewall rule that blocks requests to the femanager invitation controller from unauthorized sources

bash

# Composer update to the fixed femanager release
composer require in2code/femanager:^7.2.2
composer update in2code/femanager