CVE-2026-77133: Broken Access Control in extension "femanager" (femanager)

Published Aug 25, 2026

Updated

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.

Affected Software

1 affected component

femanager/femanager

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Restrict access to group-assignment features (frontend group membership updates) so authenticated users cannot assign themselves to arbitrary frontend usergroups via the femanager profile edit plugin default field configuration.

Event History

Aug 25, 2026

CVE Published

via MITRE·09:00 AM

Data Sourced

via MITRE·09:00 AM

DescriptionWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using the femanager profile edit plugin are exposed when it uses its default field configuration. Exploitation requires a logged-in frontend user.

What does an attacker need to do to exploit it?

The attacker needs valid frontend-user credentials and access to edit their own profile. They can then assign their account to arbitrary frontend usergroups.

Is user interaction required?

No. The CVSS vector indicates no user interaction is required, although the attacker must already have low-level privileges as a logged-in user.

CVE-2026-77133: Broken Access Control in extension "femanager" (femanager)

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Is user interaction required?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Is user interaction required?