CVE-2025-48202: Insecure Direct Object Reference in in2code/femanager TYPO3 Extension
Summary
CVE-2025-48202: The femanager TYPO3 extension allows Insecure Direct Object Reference. Affects in2code/femanager across 4 version ranges.
>= 5.5.0, < 5.5.5
>= 6.0.0, < 6.4.1
>= 7.0.0, < 7.4.2
>= 8.0.0, < 8.2.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The in2code/femanager TYPO3 extension is designed to manage frontend user accounts in TYPO3 applications. It provides functionalities such as user registration, profile management, and password recovery. However, this extension has been found to be vulnerable to an Insecure Direct Object Reference (IDOR) issue, which can expose sensitive user data if not addressed.
Vulnerability Detail
The vulnerability arises from an Insecure Direct Object Reference (IDOR) in the femanager TYPO3 extension. This flaw allows attackers to manipulate the user parameter in the newAction of the newController, enabling them to access and view frontend user data that they should not have permission to see. The potential ramifications include unauthorized access to sensitive user information, which could lead to privacy violations and further exploitation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.5.0, < 5.5.55.5.5composer require in2code/femanager:5.5.5 -
>= 6.0.0, < 6.4.16.4.1composer require in2code/femanager:6.4.1 -
>= 7.0.0, < 7.4.27.4.2composer require in2code/femanager:7.4.2 -
>= 8.0.0, < 8.2.28.2.2composer require in2code/femanager:8.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement access controls to ensure that users can only access their own data. This can be done by validating the user ID against the currently authenticated user before processing requests in the newAction method.
Conclusion
The in2code/femanager TYPO3 extension has a significant vulnerability (CVE-2025-48202) that can lead to unauthorized access to user data. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, implementing access controls can serve as a temporary workaround while updates are applied.
See every vulnerability recorded for in2code/femanager →
FAQ
CVE-2025-48202 is a vulnerability in the in2code/femanager TYPO3 extension that allows for Insecure Direct Object Reference, potentially exposing sensitive user data.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The consequences include unauthorized access to sensitive user information, which can lead to privacy violations and exploitation of user data.
You can update the femanager package using Composer with the command: composer update in2code/femanager. Ensure you are updating to a version that contains the fix.
Vulert is a monitoring tool that uses composer.lock to track and alert users in real-time for open-source vulnerabilities in their software.
References
Related vulnerabilities
Recent vulnerabilities recorded for in2code/femanager.
