{"id":"CVE-2025-7900","aliases":["EUVD-2025-22305","GHSA-rc5f-3hfv-jxp2"],"status":"published","title":"Insecure Direct Object Reference in extension \"femanager\" (femanager)","description":"The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00251,"percentile":0.16614,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-639"],"published":"2025-07-22T10:21:32Z","modified":"2026-10-28T02:30:56Z","fixes":[{"ecosystem":"Packagist","package":"in2code/femanager","fixed_in":["6.4.2","7.5.3","8.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"in2code/femanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"in2code/femanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.5.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"in2code/femanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.3.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"in2code/femanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2"}]}],"versions":["2.5.0","2.5.1","2.6.0","2.6.1","2.6.2","2.7.0","3.0.0","3.0.1","3.0.2","3.1.0","3.1.1","3.1.2","3.1.3","3.2.0","3.3.0","4.0.0","4.0.1","4.0.2","4.1.0","4.1.1","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","5.0.0","5.1.0","5.1.1","5.2.0","5.3.0","5.3.1","5.4.0","5.4.1","5.4.2","5.5.0","5.5.1","5.5.2","5.5.3","5.5.4","5.5.5","6.0.0","6.0.1","6.1.0","6.1.1","6.1.2","6.2.0","6.2.1","6.3.0","6.3.1","6.3.2","6.3.3","6.3.4","6.3.5","6.3.6","6.4.0","6.4.1"]},{"source":"osv","ecosystem":"Packagist","package":"in2code/femanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.5.3"}]}],"versions":["7.0.0","7.0.1","7.1.0","7.1.1","7.2.0","7.2.1","7.2.2","7.2.3","7.3.0","7.4.0","7.4.1","7.4.2","7.5.0","7.5.1","7.5.2"]},{"source":"osv","ecosystem":"Packagist","package":"in2code/femanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.3.1"}]}],"versions":["8.0.0","8.0.1","8.1.0","8.2.0","8.2.1","8.2.2","8.3.0"]}],"products":[{"vendor":"typo3","product":"extension \"femanager\""},{"vendor":"typo3","product":"typo3"}],"references":[{"url":"https://typo3.org/security/advisory/typo3-ext-sa-2025-010","tags":["Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7900","tags":["advisory"]},{"url":"https://github.com/in2code-de/femanager/commit/9bd9fbded4cf31f69bfe03c55d406e79050f8069","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rc5f-3hfv-jxp2"},{"url":"https://packagist.org/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7900.json","tags":["advisory"]},{"url":"https://github.com/in2code-de/femanager","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-7900","title":"Insecure Direct Object Reference in extension \"femanager\" (femanager)","description":"The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0","status":"published","published":"2025-07-22T10:21:32.123Z","modified":"2025-07-22T14:17:04.005Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:32:51.880027Z"}],"euvd":[{"id":"EUVD-2025-22305","description":"The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0","status":"published","published":"2025-07-22T10:21:32Z","modified":"2025-07-22T14:17:04Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:32:05.744165Z"}],"ghsa":[{"id":"GHSA-rc5f-3hfv-jxp2","title":"Femanager extension for TYPO3 allows Insecure Direct Object Reference","description":"The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0.","status":"published","published":"2025-07-22T12:30:43Z","modified":"2025-07-22T14:39:21Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:38:50.834587Z"}],"nvd":[{"id":"CVE-2025-7900","description":"The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0","status":"published","published":"2025-07-22T11:15:24.34Z","modified":"2026-06-17T10:05:55.643Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:11:19.382856Z"}],"osv":[{"id":"CVE-2025-7900","title":"Insecure Direct Object Reference in extension \"femanager\" (femanager)","description":"The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0","status":"published","published":"2025-07-22T10:21:32.123Z","modified":"2026-10-28T02:30:56.129218268Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"GHSA-rc5f-3hfv-jxp2","title":"Femanager extension for TYPO3 allows Insecure Direct Object Reference","description":"The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0.","status":"published","published":"2025-07-22T12:30:43Z","modified":"2025-07-22T15:12:16.221635Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:46:55.877614Z"}]}}