---
title: "CVE-2025-67719: Ibexa User Bundle is missing password change validation"
url: https://erroneo.us/security/cve/CVE-2025-67719/
description: "CVE-2025-67719 (ibexa/user (Composer (PHP))): Ibexa is a composable end-to-end DXP (Digital Experience Platform). Versions 5.0.0-beta1 through 5.0.3 do not…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-12-11
date_modified: 2025-12-11
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-67719"
kev: false
cvss: 8.5
epss: 0.00142
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-67719: Ibexa User Bundle is missing password change validation

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.1% , percentile 3: FIRST’s model estimates a 0.1% chance of exploitation activity in the next 30 days, higher than 3% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs local access needed. Lower urgency for most teams unless an attacker could already run code on the machine.
- Only applies if your dependency tree includes ibexa/user (Composer (PHP)) >= 5.0.0-beta1, < 5.0.4, fixed in 5.0.4 . Check your lockfile, including transitive dependencies.

## What it is

Ibexa is a composable end-to-end DXP (Digital Experience Platform). Versions 5.0.0-beta1 through 5.0.3 do not have password validation. During the transition from v4 to v5 an error was introduced into validation code which causes the validation of the previous password not to run as expected. This makes it possible for a logged in user to change their password in the back office without knowing the previous password. For example, if a user logs into their account and walks away without locking their workstation, an attacker could access the unattended session and change the password, therefore locking the legitimate user out. This issue is fixed in version 5.0.4.

## Affected packages

- Composer (PHP) `ibexa/user` >= 5.0.0-beta1, < 5.0.4 → fixed: 5.0.4

## Affected products (CVE record)

- ibexa user: >= 5.0.0-beta1, < 5.0.4

## Severity

- GitHub_M CVSS 4.0: 8.5 `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`
- GitHub CVSS 4.0: 9.3 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.14% probability of exploitation activity in the next 30 days; percentile 3.

## Sources

- [GitHub Advisory GHSA-x93p-w2ch-fg67](https://github.com/advisories/GHSA-x93p-w2ch-fg67)
- [CVE.org record CVE-2025-67719](https://www.cve.org/CVERecord?id=CVE-2025-67719)
- [NVD entry CVE-2025-67719](https://nvd.nist.gov/vuln/detail/CVE-2025-67719)
- [github.com](https://github.com/ibexa/user/security/advisories/GHSA-x93p-w2ch-fg67)
- [github.com](https://github.com/ibexa/user/commit/9d485bf385e6401c9f7ee80287d8ccd00f73dcf4)
- [developers.ibexa.co](https://developers.ibexa.co/security-advisories/ibexa-sa-2025-005-password-change-and-xss-vulnerabilities-in-back-office)

---
Source page: https://erroneo.us/security/cve/CVE-2025-67719/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt