An unauthenticated account takeover vulnerability in the TYPO3 femanager extension poses a high risk to user data integrity and account access control.

The vulnerability stems from a failure in the invitation controller to terminate processing after a redirect on invalid input. This allows an unauthenticated attacker to bypass authorization checks to set a new password for and re-enable any existing frontend user account.

The ability for an unauthenticated attacker to take over arbitrary user accounts creates a significant risk of unauthorized access to sensitive user data and potential privilege escalation within the application. Given the CVSS score of 8.3, this high-severity vulnerability could lead to widespread account compromise, resulting in severe reputational damage and potential loss of customer trust.

Immediate Action: Upgrade the TYPO3 femanager extension to version 8.4.2 or later immediately to resolve the improper authorization flaw.

Proactive Monitoring: Review application logs for unusual patterns of password reset requests or unexpected account re-activation events that deviate from normal user behavior.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious requests targeting the invitation controller parameters while the patch is being deployed.

Public Exploit Available: No

This vulnerability represents a critical failure in authorization logic that directly impacts the security of user accounts. Administrators must prioritize the application of the vendor-supplied update to version 8.4.2 as the primary and most effective method of remediation. Failure to patch this flaw leaves the application susceptible to unauthorized account takeovers.