CVE-2026-77146
Last modified
CVE-2026-77146 is a high-severity vulnerability rated 8.3/10 on the CVSS scale. The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is only present in the 8.x versions of the extension..
Description
The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is only present in the 8.x versions of the extension.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| TYPO3 | Extension "femanager" | >= 8.0.0, < 8.4.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-77146?
How severe is CVE-2026-77146?
How do I fix CVE-2026-77146?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-77140The extension validates the HMAC of a frontend employee edit…8.7
- CVE-2026-77141The extension resolves the targeted club record from a user-…8.8
- CVE-2026-77142The frontend company self-service editing feature relies on …8.8
- CVE-2026-77143The frontend topic editing flow does not verify on the serve…8.8
- CVE-2026-77144The frontend management plugin attributed a newly created ev…7.1
- CVE-2026-77145The permission check for the frontend management update flow…7.1
- CVE-2026-77147Improper Control of Generation of Code ('Code Injection') vu…6.5
- CVE-2026-77148A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This i…9.9
- CVE-2026-7715A vulnerability has been found in ravenwits mcp-server-arang…6.3
- CVE-2026-77150The Unlimited Elements For Elementor plugin for WordPress is…6.1
- CVE-2026-77151A security flaw has been discovered in lin-snow Ech0 up to 5…3.7
- CVE-2026-77159A symlink-following flaw was found in libvirt's qemuTPMEmula…5.5
Are you affected by CVE-2026-77146?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST