CVE-2023-50460 Overview
CVE-2023-50460 is a broken access control vulnerability in the femanager extension for TYPO3, a widely used open-source content management system. The flaw affects femanager versions 7.x prior to 7.2.3. The backend module fails to properly restrict actions that an authenticated backend user can perform against frontend user accounts. An authenticated attacker with backend access can invoke userLogout, confirmUser, refuseUser, and resendUserConfirmation operations against any frontend user in the system, regardless of intended authorization boundaries.
Critical Impact
Any authenticated TYPO3 backend user can manipulate the state of arbitrary frontend user accounts, enabling account confirmation abuse, forced logouts, and unauthorized administrative actions.
Affected Products
- TYPO3 CMS with the femanager extension installed
- femanager extension version 7.x prior to 7.2.3
- Any TYPO3 installation exposing the femanager backend module to low-privileged backend users
Discovery Timeline
- 2026-09-14 - CVE-2023-50460 published to the National Vulnerability Database (NVD)
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2023-50460
Vulnerability Analysis
The femanager extension provides frontend user management functionality for TYPO3 sites. The backend module exposes several state-changing actions intended for administrative use. These actions include userLogout, confirmUser, refuseUser, and resendUserConfirmation. The vulnerability stems from missing authorization checks on these actions. Any user with valid backend credentials can execute the actions against any frontend user record.
The issue is classified as [CWE-863: Incorrect Authorization]. The extension authenticates the requester as a backend user but does not verify that the requester holds the specific privileges required to modify the targeted frontend user account. This design flaw allows lateral abuse of administrative functionality by low-privileged backend accounts.
Root Cause
The root cause is missing or insufficient authorization enforcement in the femanager backend module controller. Action handlers rely on authentication as a sufficient gate for privileged operations. They do not evaluate whether the authenticated backend user has permission to act on the specific frontend user identifier submitted in the request. The vendor addressed this in femanager 7.2.3.
Attack Vector
Exploitation requires network access to the TYPO3 backend and valid backend credentials. An attacker with any authenticated backend session can submit crafted requests to the femanager backend module invoking one of the four affected actions with an arbitrary frontend user ID. The actions execute against the specified target without further authorization checks. This enables forced logouts of active frontend users, unauthorized confirmation of pending registrations, wrongful rejection of legitimate registrations, and abuse of the confirmation email workflow.
No verified public exploit code is available for this issue. See the TYPO3 Security Advisory #2023-010 for authoritative technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2023-50460
Indicators of Compromise
- Unexpected frontend user state transitions in TYPO3 database tables, including confirmations or refusals that do not correspond to legitimate administrative activity
- Backend audit log entries showing femanager actions (userLogout, confirmUser, refuseUser, resendUserConfirmation) invoked by backend users outside their expected duties
- Bursts of confirmation emails sent from the TYPO3 instance without corresponding registration activity
- Unexplained forced logouts reported by frontend users
Detection Strategies
- Inventory TYPO3 installations and identify those running femanager 7.x below 7.2.3
- Review TYPO3 backend logs for femanager controller invocations correlated with backend user IDs and target frontend user IDs
- Compare frontend user state changes against a baseline of expected administrative workflows
- Alert on any backend user account performing high volumes of femanager actions within a short time window
Monitoring Recommendations
- Enable and centralize TYPO3 sys_log collection to capture backend module actions and user attribution
- Forward web server access logs for backend URLs to a SIEM for correlation and retention
- Monitor outbound email volume from TYPO3 mail queues for anomalies tied to resendUserConfirmation abuse
How to Mitigate CVE-2023-50460
Immediate Actions Required
- Upgrade the femanager extension to version 7.2.3 or later on all TYPO3 instances
- Audit backend user accounts and revoke access for accounts that no longer require it
- Review recent frontend user state changes and reverse any unauthorized confirmations or refusals
- Rotate credentials for any backend accounts suspected of misuse
Patch Information
The TYPO3 project addressed the vulnerability in femanager 7.2.3. Administrators should install the patched release through the TYPO3 Extension Manager or Composer. Refer to the TYPO3 Security Advisory #2023-010 for release notes and upgrade guidance.
Workarounds
- Restrict backend access to the femanager module using TYPO3 backend user group permissions until the patched version is deployed
- Limit backend access to trusted network ranges through web server or reverse proxy access controls
- Enforce multi-factor authentication on all TYPO3 backend accounts to reduce the risk of credential-based abuse
# Upgrade femanager via Composer to the patched release
composer require in2code/femanager:^7.2.3
# Clear TYPO3 caches after upgrade
./vendor/bin/typo3 cache:flush
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
