{"id":"GHSA-q3x8-6898-23g3","aliases":[],"status":"published","title":"ibexa/user login enumerates user accounts","description":"### Impact\nIn v5, error messages could provide enough information to tell whether a user exists or not. This is resolved by ensuring the error messages are sufficiently ambigious.\n\n### Patches\nSee \"Patched versions\".\n\n### Workarounds\nNone.\n\n### Resources\nhttps://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-209"],"published":"2025-10-17T17:58:08Z","modified":"2025-10-17T18:16:40Z","fixes":[{"ecosystem":"Packagist","package":"ibexa/user","fixed_in":["5.0.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"ibexa/user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"ibexa/user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.3"}]}],"versions":["v5.0.0","v5.0.1","v5.0.2"]}],"references":[{"url":"https://github.com/ibexa/user/security/advisories/GHSA-q3x8-6898-23g3","tags":["web"]},{"url":"https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q3x8-6898-23g3"},{"url":"https://github.com/ibexa/user","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-q3x8-6898-23g3","title":"ibexa/user login enumerates user accounts","description":"### Impact\nIn v5, error messages could provide enough information to tell whether a user exists or not. This is resolved by ensuring the error messages are sufficiently ambigious.\n\n### Patches\nSee \"Patched versions\".\n\n### Workarounds\nNone.\n\n### Resources\nhttps://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office","status":"published","published":"2025-10-17T17:58:08Z","modified":"2025-10-17T17:58:09Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T14:39:01.677422Z"}],"osv":[{"id":"GHSA-q3x8-6898-23g3","title":"ibexa/user login enumerates user accounts","description":"### Impact\nIn v5, error messages could provide enough information to tell whether a user exists or not. This is resolved by ensuring the error messages are sufficiently ambigious.\n\n### Patches\nSee \"Patched versions\".\n\n### Workarounds\nNone.\n\n### Resources\nhttps://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office","status":"published","published":"2025-10-17T17:58:08Z","modified":"2025-10-17T18:16:40.113403Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T15:46:54.055966Z"}]}}