A vulnerability in the TYPO3 femanager extension allows unauthenticated visitors to bypass admin approval, posing a significant risk to user account integrity.

This is an incorrect authorization vulnerability (CWE-863). The extension fails to validate the admin-specific confirmation token, allowing an unauthenticated attacker to use a standard user hash to approve pending accounts.

The CVSS score of 8.3 reflects the potential for large-scale unauthorized account creation and privilege escalation. This can lead to significant data compromise, unauthorized access to restricted areas of the TYPO3 site, and potential reputational damage for the organization.

Immediate Action: Update the femanager extension to the latest patched version provided by the TYPO3 security advisory.

Proactive Monitoring: Audit user registration logs for a high volume of approvals or suspicious account creation patterns that bypass standard administrative workflows.

Compensating Controls: Temporarily disable self-registration features if an immediate update is not feasible to prevent the exploitation of this authorization flaw.

Public Exploit Available: Unknown.

Administrators should prioritize updating the femanager extension to secure the account registration process. Given the ease of exploitation, failure to patch could lead to unauthorized user access, which is difficult to remediate once accounts have been created.