GHSA-394j-x37r-2q27
Ibexa DXP users with the Company admin role can assign any role to any user
GHSA-394j-x37r-2q27 is a vulnerability with no CVSS score yet in ibexa/core, published November 10, 2022. No source lists public exploit code. Fixed in ibexa/core 4.2.3.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.2.3ibexa/core +1 more
Description
Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.
The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ibexa/corePackagist | 4.2.0 up to 4.2.3 | 4.2.3 |
ibexa/corePackagist | 4.2.0 up to 4.2.3, plus listed versions v4.2.0v4.2.1v4.2.2 | 4.2.3 |
What each source reports
GitHub AdvisoriesNo score
Ibexa DXP users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.
The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
- Record
GHSA-394j-x37r-2q27- Updated
- 2026-11-02
OSVNo score
Ibexa DXP users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.
The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
- Record
GHSA-394j-x37r-2q27- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/ibexa/core/security/advisories/GHSA-394j-x37r-2q27
developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips