{"id":"CVE-2023-45023","aliases":["EUVD-2023-60667","GHSA-93j4-v838-8767"],"status":"published","title":"TYPO3 extension femanager Broken Access Control vulnerability","description":"The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00194,"percentile":0.09247,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-863"],"published":"2023-10-04T17:57:18Z","modified":"2026-09-22T20:00:03Z","fixes":[{"ecosystem":"Packagist","package":"in2code/femanager","fixed_in":["7.2.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"in2code/femanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.2.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"in2code/femanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.2.2"}]}],"versions":["7.0.0","7.0.1","7.1.0","7.1.1","7.2.0","7.2.1"]}],"products":[{"vendor":"typo3","product":"femanager"}],"references":[{"url":"https://typo3.org/security/advisory/typo3-ext-sa-2023-008","tags":["web"]},{"url":"https://github.com/in2code-de/femanager/commit/cc5f2893613a6b3fd2677c457574ab587a0862ca","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/femanager/CVE-2023-45023.yaml","tags":["web"]},{"url":"https://github.com/in2code-de/femanager/releases/tag/7.2.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-93j4-v838-8767"},{"url":"https://github.com/in2code-de/femanager","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-45023","description":"The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component.","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-09-14T18:13:01.462Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-60667","description":"The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component.","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-09-14T18:13:01Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:20.0825Z"}],"ghsa":[{"id":"GHSA-93j4-v838-8767","title":"TYPO3 extension femanager Broken Access Control vulnerability","description":"femanager fails to check access permissions for the invitation component. Depending on the configuration of the plugin, a remote user can create frontend user accounts with access to configured frontend groups.","status":"published","published":"2023-10-04T17:57:18Z","modified":"2023-10-04T17:57:19Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:37:07.641671Z"}],"nvd":[{"id":"CVE-2023-45023","description":"The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component.","status":"published","published":"2026-09-14T06:16:54.207Z","modified":"2026-09-22T20:00:03.713Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:09:27.733183Z"}],"osv":[{"id":"GHSA-93j4-v838-8767","title":"TYPO3 extension femanager Broken Access Control vulnerability","description":"femanager fails to check access permissions for the invitation component. Depending on the configuration of the plugin, a remote user can create frontend user accounts with access to configured frontend groups.","status":"published","published":"2023-10-04T17:57:18Z","modified":"2024-11-28T05:44:52.248341Z","cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}