ibexa user up to 5.0.3 unverified password change

Summaryinfo

A vulnerability classified as problematic has been found in ibexa user up to 5.0.3. The affected element is an unknown function. This manipulation causes unverified password change. This vulnerability appears as CVE-2025-67719. The attack requires local access. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in ibexa user up to 5.0.3 and classified as problematic. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a unverified password change vulnerability. The CWE definition for the vulnerability is CWE-620. When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Ibexa is a composable end-to-end DXP (Digital Experience Platform). Versions 5.0.0-beta1 through 5.0.3 do not have password validation. During the transition from v4 to v5 an error was introduced into validation code which causes the validation of the previous password not to run as expected. This makes it possible for a logged in user to change their password in the back office without knowing the previous password. For example, if a user logs into their account and walks away without locking their workstation, an attacker could access the unattended session and change the password, therefore locking the legitimate user out. This issue is fixed in version 5.0.4.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-67719 since 12/10/2025. The exploitation appears to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

Upgrading to version 5.0.4 eliminates this vulnerability. Applying the patch 9d485bf385e6401c9f7ee80287d8ccd00f73dcf4 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CNNVD (CNNVD-202512-2248). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• ibexa

Name

• user

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3

License

• open-source

Website

• Product: https://github.com/ibexa/user/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion