CVE-2023-25014

Name of the Vulnerable Software and Affected Versions femanager extension versions prior to 5.5.3 femanager extension versions 6.x prior to 6.3.4 femanager extension versions 7.x prior to 7.1.0

Description The issue is related to missing access checks in the InvitationController function, allowing an unauthenticated user to delete all frontend users. This can be exploited by a remote attacker to delete arbitrary users.

Recommendations For femanager extension versions prior to 5.5.3, update to version 5.5.3 or later. For femanager extension versions 6.x prior to 6.3.4, update to version 6.3.4 or later. For femanager extension versions 7.x prior to 7.1.0, update to version 7.1.0 or later. As a temporary workaround, consider disabling the InvitationController function until a patch is available.