{"id":"CVE-2025-48202","aliases":[],"url":"https://o3.security/vulnerability/CVE-2025-48202","summary":"The femanager TYPO3 extension allows Insecure Direct Object Reference","details":"Insecure Direct Object Reference (IDOR) in the femanager TYPO3 extension allows attackers to view frontend user data via a user parameter in the newAction of the newController.","published":"2025-05-21T17:19:30Z","modified":"2025-05-21T19:38:02.789293Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C"},"epss":{"score":0.00284,"percentile":0.2104,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"in2code/femanager","fixedVersion":"8.2.2"},{"ecosystem":"Packagist","name":"in2code/femanager","fixedVersion":"7.4.2"},{"ecosystem":"Packagist","name":"in2code/femanager","fixedVersion":"6.4.1"},{"ecosystem":"Packagist","name":"in2code/femanager","fixedVersion":"5.5.5"}],"fix":{"url":"https://github.com/in2code-de/femanager/commit/54851f8f60254bd8060bdf7bc16d56f4de7bd828","label":"in2code-de/femanager@54851f8"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48202"},{"type":"WEB","url":"https://github.com/in2code-de/femanager/commit/54851f8f60254bd8060bdf7bc16d56f4de7bd828"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/femanager/CVE-2025-48202.yaml"},{"type":"PACKAGE","url":"https://github.com/in2code-de/femanager"},{"type":"WEB","url":"https://typo3.org/security/advisory/typo3-ext-sa-2025-006"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-05-21T19:38:02.789293Z"}}