GHSA-3p9x-xxx6-2w4p
Broken Access Control in 3rd party TYPO3 extension "femanager"
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | in2code/femanager | < 5.5.3 | 5.5.3 |
| Packagist | in2code/femanager | >= 6.0.0, < 6.3.4 | 6.3.4 |
| Packagist | in2code/femanager | >= 7.0.0, < 7.1.0 | 7.1.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
A missing access check in the `InvitationController` allows an unauthenticated user to delete all frontend users.
References
External links from the advisory. They lead to third-party sites.