Skip to content
Fencer Intel
medium —

GHSA-q3x8-6898-23g3 json

ibexa/user login enumerates user accounts

published last yr. modified last yr.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact In v5, error messages could provide enough information to tell whether a user exists or not. This is resolved by ensuring the error messages are sufficiently ambigious.

### Patches See "Patched versions".

### Workarounds None.

### Resources https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office

Patch / fix

  • packagist ibexa/user 5.0.3

Is GHSA-q3x8-6898-23g3 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist ibexa/user
>=5.0.0, <5.0.3
5.0.3

Classification

Weakness
  • CWE-209 Generation of Error Message Containing Sensitive Information

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.