CVE-2026-77134: Broken Access Control in extension "femanager" (femanager)

Published Aug 25, 2026

Updated

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval.

Affected Software

1 affected component

femanager

Event History

Aug 25, 2026

CVE Published

via MITRE·09:00 AM

Data Sourced

via MITRE·09:00 AM

DescriptionWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any visitor who can use the public resend-confirmation action can obtain a regular user confirmation hash. That hash can then be used to approve a pending account that is awaiting administrator approval.

What accounts are at risk?

Pending accounts configured to require administrator approval are affected. The issue allows the account holder or another visitor with a usable regular confirmation hash to bypass the dedicated administrator confirmation requirement.

Is authentication required to exploit the issue?

No. The supplied CVSS vector lists privileges required as none and user interaction as none. The described hash can be obtained through a public action available to visitors.

CVE-2026-77134: Broken Access Control in extension "femanager" (femanager)

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What accounts are at risk?

Is authentication required to exploit the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What accounts are at risk?

Is authentication required to exploit the issue?