GitHub Advisoryadvisory · Packagist

GHSA-q3x8-6898-23g3 ibexa/user login enumerates user accounts

MEDIUM Published 2025-10-17 Modified 2025-10-17 Official page ↗
Ecosystem
Packagist
Packages
ibexa/user
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-209
Reviewed
2025-10-17

Affected packages

• Packagist ibexa/user: >= 5.0.0, < 5.0.3 → fixed in 5.0.3

Description

Impact In v5, error messages could provide enough information to tell whether a user exists or not. This is resolved by ensuring the error messages are sufficiently ambigious. Patches See "Patched versions". Workarounds None. Resources https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office

Related

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References