TYPO3CMS
CVE-2025-7900
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThe femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe femanager TYPO3 extension contains an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users to modify other users' data by manipulating direct object references (likely user IDs) in requests, without proper authorization validation to verify the requesting user owns or has permission to modify the target resource.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
TYPO3CMS
<= 6.4.1>= 7.0.0, <= 7.5.2>= 8.0.0, <= 8.3.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Confirm femanager extension is installedIn TYPO3 backend, go to Admin Tools > Extensions and search for 'femanager' or list all installed extensions. Alternatively, check the file system at typo3conf/ext/ for a folder named 'femanager'.Affected if The femanager extension is present in the TYPO3 installation
-
Identify installed femanager versionIn the TYPO3 Extension Manager, click on femanager and view the version number displayed. Or read the ext_emconf.php file in typo3conf/ext/femanager/ and extract the 'version' field.Affected if Version is <= 6.4.1 OR between 7.0.0 and 7.5.2 inclusive OR between 8.0.0 and 8.3.0 inclusive
-
Locate user modification endpointsInspect the extension's PHP controllers, especially those handling user profile updates, registration, or data changes. Look for files in typo3conf/ext/femanager/Classes/Controller/ for actions that process user input.Affected if The extension exposes endpoints that accept user ID parameters (such as user_id, uid, or fe_user_id) in the request
-
Verify authorization validation exists on user modificationExamine the identified user modification controller actions. Search for authorization checks such as isLoggedIn(), getCurrentUser(), or permission checks before processing modifications. Look for code that verifies the requesting user owns the target resource.Affected if No authorization check verifies the authenticated user owns or has permission to modify the user ID being requested
-
Test for IDOR via direct object reference manipulationLog in as a frontend user. Capture a user data modification request (such as profile update) and modify the user ID parameter to a different user's ID, then submit the request. Observe if the modification affects the target user without proper authorization.Affected if Requests with manipulated user IDs succeed and modify data belonging to other users
The environment is affected if femanager extension is installed with a version in the affected ranges AND the extension exposes user modification endpoints without proper authorization checks on user ID parameters.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataUpgrade femanager to version 6.4.2, 7.5.3, or 8.3.1 or later, which contain the security fix. If immediate upgrade is not possible, implement authorization checks on all user data modification endpoints to verify the authenticated user has permission to modify the requested object.
Fix this in TYPO3
Scoped from the published advisory
- Consultation3.0 h
- Implementation6.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,984.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-7900 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-7900 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data