GHSA-pcpm-vc4v-cmvx
eZ Platform users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.
The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
What each source reports
GitHub Advisories No score
eZ Platform users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.
The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
- Record
GHSA-pcpm-vc4v-cmvx- Updated
- 2026-11-02
OSV No score
eZ Platform users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.
The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
- Record
GHSA-pcpm-vc4v-cmvx- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ezsystems/ezplatform-admin-uiPackagist |
1.5.0 up to 1.5.29 | 1.5.29 |
ezsystems/ezplatform-admin-uiPackagist |
2.3.0 up to 2.3.26 | 2.3.26 |
ezsystems/ezplatform-admin-uiPackagist |
1.5.0 up to 1.5.29, plus listed versions v1.5.0v1.5.1v1.5.10v1.5.11v1.5.12 Show 27 moreShow lessv1.5.13v1.5.14v1.5.15v1.5.16v1.5.17v1.5.18v1.5.19v1.5.2v1.5.20v1.5.21v1.5.22v1.5.23v1.5.24v1.5.25v1.5.25.1v1.5.26v1.5.27v1.5.28v1.5.3v1.5.4v1.5.5v1.5.6v1.5.7v1.5.8v1.5.8-rc1v1.5.9v1.5.9-rc1 |
1.5.29 |
ezsystems/ezplatform-admin-uiPackagist |
2.3.0 up to 2.3.26, plus listed versions v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12 Show 21 moreShow lessv2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.19v2.3.2v2.3.20v2.3.21v2.3.22v2.3.23v2.3.24v2.3.25v2.3.3v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9 |
2.3.26 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-pcpm-vc4v-cmvx is a vulnerability with no CVSS score yet in ezsystems/ezplatform-admin-ui, published November 10, 2022. No source lists public exploit code. Fixed in ezsystems/ezplatform-admin-ui 1.5.29.
References
github.com/ezsystems/ezplatform-admin-ui/security/advisories/GHSA-pcpm-vc4v-cmvx
developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips