GHSA-446q-xxg5-3vhh
eZ Platform users with the Company admin role can assign any role to any user
GHSA-446q-xxg5-3vhh is a vulnerability with no CVSS score yet in ezsystems/repository-forms, published November 10, 2022. No source lists public exploit code. Fixed in ezsystems/repository-forms 2.5.15.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.5.15ezsystems/repository-forms +1 more
Description
Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.
The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ezsystems/repository-formsPackagist | 2.5.0 up to 2.5.15 | 2.5.15 |
ezsystems/repository-formsPackagist | 2.5.0 up to 2.5.15, plus listed versions v2.5.0v2.5.1v2.5.10v2.5.11v2.5.12 Show 12 moreShow lessv2.5.13v2.5.14v2.5.2v2.5.3v2.5.4v2.5.5v2.5.5-rc1v2.5.6v2.5.6-rc1v2.5.7v2.5.8v2.5.9 | 2.5.15 |
What each source reports
GitHub AdvisoriesNo score
eZ Platform users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.
The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
- Record
GHSA-446q-xxg5-3vhh- Updated
- 2026-11-02
OSVNo score
eZ Platform users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.
The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
- Record
GHSA-446q-xxg5-3vhh- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/ezsystems/repository-forms/security/advisories/GHSA-446q-xxg5-3vhh
developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips