MEDIUM

GHSA-q3x8-6898-23g3

ibexa/user login enumerates user accounts

Quick fix

GHSA-q3x8-6898-23g3 — ibexa/user: upgrade to the fixed version with the command below.

composer require ibexa/user:^5.0.3

Details

### Impact In v5, error messages could provide enough information to tell whether a user exists or not. This is resolved by ensuring the error messages are sufficiently ambigious.

### Patches See "Patched versions".

### Workarounds None.

### Resources https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/ibexa/user

Introduced in: 5.0.0Fixed in: 5.0.3

Fixcomposer require ibexa/user:^5.0.3

References

https://github.com/ibexa/user/security/advisories/GHSA-q3x8-6898-23g3[WEB]
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office[WEB]
https://github.com/ibexa/user[PACKAGE]