Packagist/ezsystems/repository-forms: critical
eZ Platform users with the Company admin role can assign any role to any user
Action: Upgrade ezsystems/repository-forms to 2.5.15 or later.
composer require ezsystems/repository-forms:2.5.15Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.5.0 | 2.5.15 | - |
Fixed versions
| 2.5.15 |
Sources
- osv: GHSA-446q-xxg5-3vhh
- https://github.com/ezsystems/repository-forms/security/advisories/GHSA-446q-xxg5-3vhh
- https://github.com/ezsystems/repository-forms/commit/cac51487f8a10e48448399bedb45a519874f1006
- https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips
- https://github.com/ezsystems/repository-forms
published · modified · JSON