GHSA-r3fg-3r88-6x3f
Ibexa User Settings are accessible on the front-end for anonymous user
GHSA-r3fg-3r88-6x3f is a medium vulnerability (CVSS 5.4) in ibexa/user, published May 10, 2023. No source lists public exploit code. Fixed in ibexa/user 4.4.3.
- Severity
- 5.4 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.4.3ibexa/user +1 more
Description
Impact
This security advisory is about the user settings, which include things like preferred time zone and number of items per page in item listings. These could be accessed by the anonymous user. This impacted only the anonymous users themselves, and had no impact on logged in users. As such the impact is limited, even if custom user settings have been added, but please consider if this matters for your site. The fix ensures that only logged in users can access their user settings.
References
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ibexa/userPackagist | 4.0.0 up to 4.4.3 | 4.4.3 |
ibexa/userPackagist | 4.0.0 up to 4.4.3, plus listed versions v4.0.0v4.0.1v4.0.2v4.0.3v4.0.4 Show 32 moreShow lessv4.0.5v4.0.6v4.0.7v4.0.8v4.1.0v4.1.0-beta1v4.1.0-rc1v4.1.1v4.1.2v4.1.3v4.1.4v4.1.5v4.2.0v4.2.0-beta1v4.2.0-rc1v4.2.1v4.2.2v4.2.3v4.2.4v4.3.0v4.3.0-beta1v4.3.0-rc1v4.3.1v4.3.2v4.3.3v4.3.4v4.3.5v4.4.0v4.4.0-beta1v4.4.0-rc1v4.4.1v4.4.2 | 4.4.3 |
What each source reports
GitHub Advisories Score used
Ibexa User Settings are accessible on the front-end for anonymous user
Impact
This security advisory is about the user settings, which include things like preferred time zone and number of items per page in item listings. These could be accessed by the anonymous user. This impacted only the anonymous users themselves, and had no impact on logged in users. As such the impact is limited, even if custom user settings have been added, but please consider if this matters for your site. The fix ensures that only logged in users can access their user settings.
References
- Record
GHSA-r3fg-3r88-6x3f- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSV
Ibexa User Settings are accessible on the front-end for anonymous user
Impact
This security advisory is about the user settings, which include things like preferred time zone and number of items per page in item listings. These could be accessed by the anonymous user. This impacted only the anonymous users themselves, and had no impact on logged in users. As such the impact is limited, even if custom user settings have been added, but please consider if this matters for your site. The fix ensures that only logged in users can access their user settings.
References
- Record
GHSA-r3fg-3r88-6x3f- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/ibexa/user/security/advisories/GHSA-r3fg-3r88-6x3f
developers.ibexa.co/security-advisories/ibexa-sa-2023-002-user-settings-are-accessible-on-the-front-end-for-the-anonymous-user