CVE-2025-67719: Ibexa User Bundle is missing password change validation

Should you act?

Normal patch cycle

No exploitation signal; fix it in your next routine update if you are affected. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 0.1%, percentile 3: FIRST’s model estimates a 0.1% chance of exploitation activity in the next 30 days, higher than 3% of all scored CVEs (low). EPSS is a probability, not a verdict.
• Needs local access needed. Lower urgency for most teams unless an attacker could already run code on the machine.
• Only applies if your dependency tree includes ibexa/user (Composer (PHP)) >= 5.0.0-beta1, < 5.0.4, fixed in 5.0.4. Check your lockfile, including transitive dependencies.

What it is

Ibexa is a composable end-to-end DXP (Digital Experience Platform). Versions 5.0.0-beta1 through 5.0.3 do not have password validation. During the transition from v4 to v5 an error was introduced into validation code which causes the validation of the previous password not to run as expected. This makes it possible for a logged in user to change their password in the back office without knowing the previous password. For example, if a user logs into their account and walks away without locking their workstation, an attacker could access the unattended session and change the password, therefore locking the legitimate user out. This issue is fixed in version 5.0.4.

From the GitHub advisory

Impact The vulnerability is in the password change dialog in the back office. During the transition from v4 to v5 a mistake was made in the validation code which caused the validation of the previous password to not run as expected. This made it possible for a logged in user to change password in the back office without knowing the previous password. For example if someone logs in, leaves their workstation unlocked, and another person uses the same machine.

Credit The issue was reported to us by Code-Rhapsodie. We thank them for their responsible disclosure! https://www.code-rhapsodie.fr/

Patches - See "Patched versions". - https://github.com/ibexa/user/commit/9d485bf385e6401c9f7ee80287d8ccd00f73dcf4

Workarounds None.

Weakness type: CWE-620.

Product: ibexa/user (Composer (PHP)) · Assigned by: GitHub_M · Published: 2025-12-11

Affected and fixed versions

Severity scores

• Attack vector: local access needed
• Attack complexity: low
• Attack requirements: none
• Privileges required: none (no login)
• User interaction: none

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• FIRST EPSS (model of 2026-10-21): 0.14% probability of exploitation activity in the next 30 days; percentile 3.

Timeline

• 2025-12-10 — GitHub-reviewed advisory GHSA-x93p-w2ch-fg67 published (critical)
• 2025-12-11 — CVE record last updated
• 2025-12-11 — CVE record published by GitHub_M

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-x93p-w2ch-fg67 github.com
2. CVE.org record CVE-2025-67719 cve.org
3. NVD entry CVE-2025-67719 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. developers.ibexa.co developers.ibexa.co

Critical Composer (PHP) advisories · Today’s Security Digest