CVE-2026-77146: Broken Access Control in extension "femanager" (femanager)

Q: Which deployments should be treated as affected?

The vulnerability is present only in 8.x versions of the femanager extension. Deployments using other version branches are not identified as affected by the provided information.

Q: Does exploitation require an authenticated account or user interaction?

No. An unauthenticated attacker can exploit the issue, and no user interaction is required.

Q: What account impact can an attacker achieve?

An attacker can set a new password for an arbitrary existing frontend user account and re-enable that account. The vulnerable processing path is reached when invitation input is invalid, including a missing hash or references to non-existent, disabled, or deleted users.

Published Aug 25, 2026

Updated

The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is only present in the 8.x versions of the extension.

Affected Software

1 affected component

femanager>=8.0<9.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Modify the extension so that after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), execution terminates immediately and no further password-setting/re-enabling logic is reached (broken access control fix in the invitation controller).
femanager (invitation controller) invitation/redirect handling for invalid users = Stop processing after redirect
Compensating control
Restrict access to the Femanager invitation/password-reset endpoints so unauthenticated users cannot reach the invitation controller (e.g., only allow requests from authenticated/authorized sessions at the application layer or via an upstream WAF/ACL).

Event History

Aug 25, 2026

CVE Published

via MITRE·09:00 AM

Data Sourced

via MITRE·09:00 AM

DescriptionWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments should be treated as affected?

The vulnerability is present only in 8.x versions of the femanager extension. Deployments using other version branches are not identified as affected by the provided information.

Does exploitation require an authenticated account or user interaction?

No. An unauthenticated attacker can exploit the issue, and no user interaction is required.

What account impact can an attacker achieve?

An attacker can set a new password for an arbitrary existing frontend user account and re-enable that account. The vulnerable processing path is reached when invitation input is invalid, including a missing hash or references to non-existent, disabled, or deleted users.

CVE-2026-77146: Broken Access Control in extension "femanager" (femanager)

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments should be treated as affected?

Does exploitation require an authenticated account or user interaction?

What account impact can an attacker achieve?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be treated as affected?

Does exploitation require an authenticated account or user interaction?

What account impact can an attacker achieve?