GHSA-mm8v-wmqx-8h2j
Broken Access Control in 3rd party TYPO3 extension "femanager"
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | in2code/femanager | < 5.5.3 | 5.5.3 |
| Packagist | in2code/femanager | >= 6.0.0, < 6.3.4 | 6.3.4 |
| Packagist | in2code/femanager | >= 7.0.0, < 7.1.0 | 7.1.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
A missing access check in the `InvitationController` allows an unauthenticated user with a valid invitation link to set the password of all frontend users.
References
External links from the advisory. They lead to third-party sites.