CVE-2025-67719 json
Ibexa User Bundle is missing password change validation
published 2025-12-10 10 mo ago modified 2026-10-08 32 d ago also GHSA-x93p-w2ch-fg67 , EUVD-2025-202462
- cvss
- 8.5
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 3%
- public exploits
- 0
- none known
Summary
Ibexa is a composable end-to-end DXP (Digital Experience Platform). Versions 5.0.0-beta1 through 5.0.3 do not have password validation. During the transition from v4 to v5 an error was introduced into validation code which causes the validation of the previous password not to run as expected. This makes it possible for a logged in user to change their password in the back office without knowing the previous password. For example, if a user logs into their account and walks away without locking their workstation, an attacker could access the unattended session and change the password, therefore locking the legitimate user out. This issue is fixed in version 5.0.4.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 10 mo ago
Exploit prediction
0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | ibexa/user | >=5.0.0-beta1, <5.0.4 |
5.0.4 |
Affected products
- ibexa user
Classification
- Weakness
-
- CWE-620 Unverified Password Change
References
-
github.com
/ibexa/user/commit/9d485bf385e6401c9f7ee80287d8ccd00f73dcf4
web
-
github.com
/ibexa/user/security/advisories/GHSA-x93p-w2ch-fg67
web
-
developers.ibexa.co
/security-advisories/ibexa-sa-2025-005-password-change-and-xss-vulnerabilities-in-back-office
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-67719
advisory
-
github.com
/ibexa/user
package
Sources
- CVE List CVE-2025-67719
- GitHub Advisory GHSA-x93p-w2ch-fg67
- NVD CVE-2025-67719
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.