GHSA-q3x8-6898-23g3

Source

https://github.com/advisories/GHSA-q3x8-6898-23g3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q3x8-6898-23g3/GHSA-q3x8-6898-23g3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-q3x8-6898-23g3

Published

2025-10-17T17:58:08Z

Modified

2025-10-17T18:16:40Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

ibexa/user login enumerates user accounts

Details

Impact

In v5, error messages could provide enough information to tell whether a user exists or not. This is resolved by ensuring the error messages are sufficiently ambigious.

Patches

See "Patched versions".

Workarounds

None.

Resources

https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office

Database specific

{
    "cwe_ids":  [
        "CWE-209"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-10-17T17:58:08Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / ibexa/user

Package

Name: ibexa/user
Purl: pkg:composer/ibexa/user

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0

Fixed

5.0.3

Affected versions

v5.*

v5.0.0

v5.0.1

v5.0.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-q3x8-6898-23g3/GHSA-q3x8-6898-23g3.json"