Every CVE Search/ Get API key

CVE-2021-46876

Duplicate Advisory: User account enumeration in eZ Publish Ibexa Kernel

5.3 MediumFix available

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.51%Up 0.5 points since Mar 12, 2023
90%50%10%1%

What each source reports

NVD Score used 5.3

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.

Record
CVE-2021-46876
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02
CVE List 5.3

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.

Record
CVE-2021-46876
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02
EUVDEUVD-2023-0942 5.3

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.

Record
EUVD-2023-0942
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-89p3-9j8c-fqh4 5.3

Duplicate Advisory: User account enumeration in eZ Publish Ibexa Kernel

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-gmrf-99gw-vvwj. This link is maintained to preserve external references.

Original Description

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.

Record
GHSA-89p3-9j8c-fqh4
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02
GitHub AdvisoriesGHSA-gmrf-99gw-vvwj 5.3

/user/sessions endpoint allows detecting valid accounts

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.

If you come across a security issue in our products, here is how you can report it to us: https://doc.ibexa.co/en/latest/guide/reporting_issues/#toc

Record
GHSA-gmrf-99gw-vvwj
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02
OSVGHSA-89p3-9j8c-fqh4 5.3

Duplicate Advisory: User account enumeration in eZ Publish Ibexa Kernel

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-gmrf-99gw-vvwj. This link is maintained to preserve external references.

Original Description

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.

Record
GHSA-89p3-9j8c-fqh4
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02
OSVGHSA-gmrf-99gw-vvwj 5.3

/user/sessions endpoint allows detecting valid accounts

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.

If you come across a security issue in our products, here is how you can report it to us: https://doc.ibexa.co/en/latest/guide/reporting_issues/#toc

Record
GHSA-gmrf-99gw-vvwj
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ezsystems/ezpublish-kernel
Packagist
 6.13.0 to 6.13.8.0
6.13.8.1
ezsystems/ezpublish-kernel
Packagist
 7.5.0 to 7.5.15.0
7.5.15.1
ezsystems/ezpublish-kernel
Packagist
 6.13.0 up to 6.13.8.1, plus listed versions
v6.13.0v6.13.0.1v6.13.1v6.13.1-rc1v6.13.1.1
Show 23 moreShow less
v6.13.1.2v6.13.2v6.13.2-beta1v6.13.2-rc1v6.13.3v6.13.3-beta1v6.13.3-rc1v6.13.4v6.13.4-beta1v6.13.4-rc1v6.13.5v6.13.5.1v6.13.6v6.13.6-rc1v6.13.6.2v6.13.6.3v6.13.6.4v6.13.6.5v6.13.6.6v6.13.7-beta1+EZP-30823.previewv6.13.7-beta2v6.13.8v6.13.8-rc1
6.13.8.1
ezsystems/ezpublish-kernel
Packagist
 7.5.0 up to 7.5.15.1, plus listed versions
v7.5.0v7.5.1v7.5.10v7.5.11v7.5.12
Show 16 moreShow less
v7.5.13v7.5.14v7.5.15v7.5.2v7.5.3v7.5.4v7.5.5v7.5.6v7.5.6-rc1v7.5.6.2v7.5.7v7.5.7-rc1v7.5.7.1v7.5.8v7.5.9v7.5.9.1
7.5.15.1

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-46876 is a medium vulnerability (CVSS 5.3) in Ibexa Ez Platform Kernel, published March 11, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in ezsystems/ezpublish-kernel 6.13.8.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open