CVE-2023-50459: TYPO3 femanager Auth Bypass Vulnerability

CVE-2023-50459 Overview

CVE-2023-50459 is a broken access control vulnerability [CWE-863] in the femanager extension for TYPO3 content management system. The flaw affects femanager versions 7.x prior to 7.2.3. The extension fails to verify access permissions in the edit user component. An authenticated frontend user can exploit this weakness to modify data belonging to other frontend users or delete arbitrary frontend user accounts. The issue is documented in TYPO3 Security Advisory 2023-010.

Critical Impact
Any authenticated frontend user can edit or delete other frontend user accounts, leading to account takeover and data integrity loss across the site.

Affected Products

TYPO3 femanager extension versions 7.0.0 through 7.2.2
TYPO3 CMS installations using the vulnerable femanager extension
Frontend user management workflows relying on femanager for registration and profile editing

Discovery Timeline

2026-09-14 - CVE-2023-50459 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2023-50459

Vulnerability Analysis

The femanager extension provides frontend user management for TYPO3, including registration, profile editing, and account deletion. The edit user component does not enforce ownership checks before processing update or delete requests. As a result, an authenticated frontend user can submit crafted requests targeting the record identifier of another user. The backend processes these operations without validating that the requester owns the target record. This is a classic authorization flaw categorized under CWE-863: Incorrect Authorization.

Root Cause

The root cause is missing access control logic in the edit user controller path. The extension authenticates the frontend user session but does not authorize the specific object being modified. Object-level authorization is required whenever a user acts on records they may not own. Without this check, the user identifier passed in the request becomes trusted input.

Attack Vector

Exploitation requires only a valid authenticated frontend user session. The attacker manipulates the user identifier submitted to the edit or delete endpoints exposed by femanager. The server processes the request against the specified user record and returns success. No user interaction from the victim is required, and the attack occurs over the network via standard HTTP requests to the TYPO3 site.

No public proof-of-concept code has been released for this vulnerability. See the TYPO3 Security Advisory 2023-010 for vendor-supplied details.

Detection Methods for CVE-2023-50459

Indicators of Compromise

Unexpected modifications to frontend user profile fields such as email address, password, or username
Unexplained deletions of frontend user accounts in the fe_users table
HTTP POST requests to femanager edit or delete endpoints referencing user identifiers that do not match the authenticated session
Sudden spikes in edit or delete actions from a single authenticated frontend session

Detection Strategies

Enable TYPO3 system logging and inspect entries generated by the femanager extension for cross-user record access
Correlate authenticated session identifiers against the fe_user field of modified records to surface mismatches
Deploy web application firewall rules that flag POST parameters targeting user IDs outside the current session context

Monitoring Recommendations

Monitor the TYPO3 sys_log and sys_history tables for fe_users update and delete operations
Alert on frontend user account deletions outside of administrator-initiated workflows
Track version and patch state of installed TYPO3 extensions to identify unpatched femanager instances

How to Mitigate CVE-2023-50459

Immediate Actions Required

Upgrade the femanager extension to version 7.2.3 or later on all TYPO3 installations
Audit the fe_users table for unauthorized changes and restore records from backup where tampering is confirmed
Force password resets for frontend user accounts if account takeover is suspected

Patch Information

The maintainers of femanager released version 7.2.3, which adds the missing access permission checks to the edit user component. Administrators should update through the TYPO3 Extension Manager or Composer using composer require in2code/femanager:^7.2.3. Refer to TYPO3 Security Advisory 2023-010 for the official vendor guidance.

Workarounds

Temporarily disable the frontend edit user functionality provided by femanager if immediate patching is not feasible
Restrict access to femanager edit and delete plugin pages using TYPO3 access group configuration
Deploy WAF rules that reject requests where the submitted user identifier does not correspond to the authenticated session

bash

# Update femanager via Composer
composer require in2code/femanager:^7.2.3
composer update in2code/femanager

# Clear TYPO3 caches after upgrade
./vendor/bin/typo3 cache:flush