{"action":"Upgrade ibexa/user to 5.0.4 or later.","affected":[{"fixed":"5.0.4","introduced":"5.0.0-beta1"}],"component":"ibexa/user","cve_ids":["CVE-2025-67719"],"ecosystem":"Packagist","epss":0.00141,"exploited":false,"fixed_versions":["5.0.4"],"ghsa_id":"GHSA-x93p-w2ch-fg67","id":"tcs_01M5KFAWVP96CP6M0J1K15KPZJ","modified_at":"2025-12-11T16:21:06.670018Z","published_at":"2025-12-10T18:20:55Z","references":["https://osv.dev/vulnerability/GHSA-x93p-w2ch-fg67","https://github.com/ibexa/user/security/advisories/GHSA-x93p-w2ch-fg67","https://nvd.nist.gov/vuln/detail/CVE-2025-67719","https://github.com/ibexa/user/commit/9d485bf385e6401c9f7ee80287d8ccd00f73dcf4","https://developers.ibexa.co/security-advisories/ibexa-sa-2025-005-password-change-and-xss-vulnerabilities-in-back-office","https://github.com/ibexa/user"],"severity":{"label":"high","score":8.5},"sources":[{"source":"osv","source_id":"GHSA-x93p-w2ch-fg67","url":"https://osv.dev/vulnerability/GHSA-x93p-w2ch-fg67"},{"source":"nvd","source_id":"CVE-2025-67719","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67719"}],"summary":"Ibexa User Bundle is missing password change validation"}