CVE-2025-48202: TYPO3-EXT-SA-2025-006: Insecure Direct Object Reference in extension "femanager" (femanager)
Insecure Direct Object Reference (IDOR) in the femanager TYPO3 extension allows attackers to view frontend user data via a user parameter in the newAction of the newController.
Other sources
The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.
— NVD
TYPO3-EXT-SA-2025-006: Insecure Direct Object Reference in extension "femanager" (femanager)
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/in2code/femanagerto a version that resolves this vulnerability.Fixed in 5.5.5 - Upgrade
Upgrade
composer/in2code/femanagerto a version that resolves this vulnerability.Fixed in 6.4.1 - Upgrade
Upgrade
composer/in2code/femanagerto a version that resolves this vulnerability.Fixed in 7.4.2 - Upgrade
Upgrade
composer/in2code/femanagerto a version that resolves this vulnerability.Fixed in 8.2.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48202?
CVE-2025-48202 is classified as a medium severity vulnerability due to the potential for unauthorized access to sensitive user data.
How do I fix CVE-2025-48202?
To fix CVE-2025-48202, update the femanager extension to version 8.2.2 or later.
What software is affected by CVE-2025-48202?
CVE-2025-48202 affects the TYPO3 femanager extension versions up to and including 8.2.1.
What kind of vulnerability is CVE-2025-48202?
CVE-2025-48202 is an Insecure Direct Object Reference (IDOR) vulnerability.
Who can be impacted by CVE-2025-48202?
Users of the TYPO3 femanager extension who have not updated to the patched version may be impacted by CVE-2025-48202.