User Data Exposure Vulnerability in TYPO3 List and Detail Plugins
CVE-2026-77135

8.2HIGH

Key Information:

Vendor

Typo3

Status
Extension "femanager"
Vendor
CVE Published:
25 August 2026

What is CVE-2026-77135?

The TYPO3 List and Detail plugins contain a vulnerability that permits unverified access to user records. This flaw enables any visitor with access to these plugins to obtain sensitive frontend user data, such as names, email addresses, dates of birth, and physical addresses, simply by providing an arbitrary user ID. The lack of proper verification mechanisms poses a significant risk to user privacy and data security, making it crucial for affected users to promptly apply mitigations or updates.

Affected Version(s)

Extension "femanager" 13.0.0 < 13.3.5

Extension "femanager" 8.0.0 < 8.4.2

Extension "femanager" 7.0.0 < 7.5.5

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-024
vendor-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arpit Jain
in2code
.