CVE-2026-77146: 
PHP vulnerability analysis and mitigation

CVE-2026-77146 is an authentication bypass vulnerability in the TYPO3 extension femanager (package in2code/femanager) that allows an unauthenticated attacker to set a new password for and re-enable any existing frontend user account. The flaw exists exclusively in the 8.x branch of the extension (versions 8.0.0 through 8.4.1). It was published on August 25, 2026, with TYPO3 as the assigning CNA. The vulnerability carries a CVSS v4.0 base score of 8.3 (High) (GitHub Advisory, TYPO3 Advisory).

The root cause is classified as CWE-862 (Missing Authorization). The extension's invitation controller fails to halt execution after issuing a redirect in response to invalid input — such as a missing or invalid hash, or a non-existent, disabled, or deleted user. Because processing continues past the redirect, an unauthenticated attacker can submit a crafted request to the invitation controller endpoint that bypasses the intended validation flow, ultimately allowing them to set an arbitrary password and re-enable any frontend user account. The attack requires no privileges and no user interaction, though the CVSS v4.0 metric notes that certain deployment/execution conditions (Attack Requirements: Present) must be in place for the invitation feature to be reachable (GitHub Advisory, TYPO3 Advisory).

Successful exploitation allows an unauthenticated attacker to take over any existing TYPO3 frontend user account by resetting its password and re-enabling it, even if the account was previously disabled or soft-deleted. This results in unauthorized access to user-specific data and functionality within the TYPO3 frontend, with a high integrity impact on the vulnerable system. Confidentiality impact is rated low (limited information exposure), and there is no direct availability impact; however, account takeover could serve as a stepping stone for further abuse of application features or data accessible to the compromised accounts (GitHub Advisory, TYPO3 Advisory).

As of the disclosure date (August 25, 2026), there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is reported at 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been made (GitHub Advisory, TYPO3 Advisory).

1. Reconnaissance: Identify TYPO3 sites using the femanager extension version 8.0.0–8.4.1 (e.g., by inspecting page source for femanager-specific form fields or plugin signatures, or by querying public CMS fingerprinting tools).
2. Locate the invitation controller endpoint: Identify the URL path exposed by the femanager invitation plugin on the target TYPO3 frontend (typically a page configured with the femanager invitation plugin).
3. Craft a malicious request: Submit a POST request to the invitation controller endpoint with invalid or missing parameters (e.g., an empty or omitted invitation hash). Due to the missing authorization check, the controller continues processing past the redirect that should terminate the request.
4. Set a new password: Include a target frontend user identifier and a chosen new password in the request body. The controller, failing to stop after the invalid-input redirect, applies the password change and re-enables the account.
5. Authenticate as the victim: Log in to the TYPO3 frontend using the targeted user's credentials with the newly set password, gaining full access to that account's data and privileges (TYPO3 Advisory, GitHub Advisory).

• Network: Unexpected POST requests to the femanager invitation controller endpoint (e.g., URLs containing tx_femanager plugin parameters) with missing, empty, or malformed hash values from unauthenticated sources.
• Logs: TYPO3 frontend access logs showing repeated or anomalous requests to the invitation plugin page, particularly with invalid hash parameters; log entries indicating password changes for accounts that were disabled or deleted.
• Application: Frontend user accounts that were previously disabled or deleted appearing as active with recently changed passwords; audit trail entries (if TYPO3 logging is enabled) showing password resets not initiated by the account owner or an administrator.
• Authentication: Successful logins from previously inactive or deleted frontend user accounts, especially from unfamiliar IP addresses (TYPO3 Advisory).

Update the femanager extension to version 8.4.2 or later, which contains the fix for this vulnerability. As an interim workaround, disable or restrict access to the invitation controller endpoint (e.g., by removing or unpublishing the TYPO3 page hosting the femanager invitation plugin) until patching is completed. Additionally, review frontend user accounts for unauthorized password changes or unexpected re-enablement of disabled/deleted accounts, and monitor audit logs for suspicious invitation controller activity (TYPO3 Advisory, GitHub Advisory).

The vulnerability was disclosed by TYPO3 through their official security advisory channel (TYPO3-EXT-SA-2026-024) and was picked up by standard CVE aggregation services shortly after publication. No notable independent researcher commentary, social media discussion, or significant media coverage has been identified beyond routine CVE tracking and aggregation (TYPO3 Advisory).