PT-2025-50566 · Ibexa · Ibexa

Published 2025-12-11 · Updated 2025-12-12 · CVE-2025-67719

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ibexa versions 5.0.0-beta1 through 5.0.3

Description Ibexa is a composable end-to-end DXP (Digital Experience Platform). Versions 5.0.0-beta1 through 5.0.3 lack proper password validation during password changes. An error introduced during the transition from version 4 to version 5 prevents the previous password validation from running as expected. This allows a logged-in user to change their password without knowing the previous password. An attacker could exploit this by accessing an unattended session and changing the password, effectively locking the legitimate user out of their account.

Recommendations Upgrade to version 5.0.4.

Exploit

Fix

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2025-67719

GHSA-X93P-W2CH-FG67

Affected Products

Ibexa

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67719.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67719 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67719 · Vendor Advisory
• https://github.com/ibexa/user/security/advisories/GHSA-x93p-w2ch-fg67 · Note
• https://github.com/ibexa/user/commit/9d485bf385e6401c9f7ee80287d8ccd00f73dcf4 · Note
• https://reddit.com/r/VulnMatter/comments/1pkvele/resumen_diario_de_vulnerabilidades_12122025 · Reddit Post
• https://t.me/cveNotify/145401 · Telegram Post
• https://twitter.com/CVEnew/status/1999108886847226305 · Twitter Post
• https://t.me/CVEtracker/39435 · Telegram Post
• https://developers.ibexa.co/security-advisories/ibexa-sa-2025-005-password-change-and-xss-vulnerabilities-in-back-office · Note
• https://twitter.com/offseq/status/1999004614071562484 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1999045552189624797 · Twitter Post