CVE-2022-44543: 
PHP vulnerability analysis and mitigation

The femanager extension for TYPO3 CMS contained a broken access control vulnerability (CVE-2022-44543) that affected versions before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1. The vulnerability was disclosed on November 2, 2022, and impacted the user registration functionality of the extension (TYPO3 Advisory).

The vulnerability stems from a mishandling of the usergroup.inList protection mechanism. When the usergroup field is available in the registration form, the validation can be bypassed, allowing new frontend users to be created as members of restricted groups. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability allows unauthorized users to create frontend user accounts with membership in restricted groups, potentially gaining access to protected content or functionality that should be limited to specific user groups. This only affects installations where the usergroup field is exposed in the registration form (TYPO3 Advisory).

The vulnerability has been fixed in versions 5.5.2, 6.3.3, and 7.0.1 of the femanager extension. Users are advised to update to these patched versions as soon as possible. The updated versions can be obtained through the TYPO3 extension manager, Packagist, or directly from the TYPO3 extension repository (TYPO3 Advisory).