CVE-2025-7900: Insecure Direct Object Reference in in2code/femanager Extension for TYPO3
Summary
CVE-2025-7900: Femanager extension for TYPO3 allows Insecure Direct Object Reference. Affects in2code/femanager across 3 version ranges.
< 6.4.2
>= 7.0.0, < 7.5.3
>= 8.0.0, < 8.3.1
Fixed in 6.4.2, 7.5.3 or 8.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The in2code/femanager extension for TYPO3 is a widely used package that facilitates user management within TYPO3 applications. It provides features for user registration, login, and profile management, making it essential for many TYPO3-based websites. However, the extension has been found to have vulnerabilities that can lead to unauthorized access and modification of user data.
Vulnerability Detail
The femanager extension for TYPO3 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. This flaw allows attackers to manipulate user data by directly accessing user-related resources without proper authorization checks. As a result, unauthorized users may modify userdata, leading to potential data breaches and privacy violations. This vulnerability affects femanager versions 6.4.1 and below, 7.0.0 to 7.5.2, and 8.0.0 to 8.3.0.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.4.26.4.2composer require in2code/femanager:6.4.2 -
>= 7.0.0, < 7.5.37.5.3composer require in2code/femanager:7.5.3 -
>= 8.0.0, < 8.3.18.3.1composer require in2code/femanager:8.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, consider restricting access to the femanager functionalities until the patch can be applied. Implement additional authorization checks in your application to ensure that users cannot access or modify data that they do not own.
Conclusion
The CVE-2025-7900 vulnerability in the in2code/femanager extension poses significant risks to user data security. It is crucial for users of affected versions to update to the latest patched versions to mitigate these risks. Regular monitoring and security practices are essential to maintain the integrity of your TYPO3 applications.
See every vulnerability recorded for in2code/femanager →
FAQ
CVE-2025-7900 is a vulnerability identifier for an Insecure Direct Object Reference found in the in2code/femanager extension for TYPO3.
The vulnerability affects femanager versions 6.4.1 and below, 7.0.0 to 7.5.2, and 8.0.0 to 8.3.0.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The risks include unauthorized modification of user data, potential data breaches, and privacy violations, which could lead to legal and reputational consequences.
If you cannot update immediately, implement additional authorization checks and restrict access to the femanager functionalities until the patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for in2code/femanager.
