Access control issue in ezsystems/ezpublish-kernel
Access control based on object state is mishandled. This is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of the object state. Depending on how your frontent is designed, knowing the URL to the content may or may not be required to access it. If you are using object state limitations in your roles, this issue is critical. Please apply the fix as soon as possible.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | ezsystems/ezpublish-kernel | >= 7.5.0, < 7.5.28 | 7.5.28 |
References
- https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-5x4f-7xgq-r42x
- https://github.com/ezsystems/ezpublish-kernel/commit/133c33cbcaa330953d6283865153f3dfdc7a2e45
- https://developers.ibexa.co/security-advisories/ibexa-sa-2022-004-ineffective-object-state-limitation-and-unauthenticated-fastly-purge
- https://github.com/ezsystems/ezpublish-kernel
- https://nvd.nist.gov/vuln/detail/CVE-2022-48367
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-281, CWE-862- Platform
- Composer
- Package
ezsystems/ezpublish-kernel- Disclosed
- 29.04.2022
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-5x4f-7xgq-r42x - CC BY 4.0
OSV / GitHub Advisory Database - GHSA-h5v2-wrhp-5v35 - CC BY 4.0
Vulnerability history: ezsystems/ezpublish-kernel
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 14
- First → latest
- 03.2021 05.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 5
- High 5
- Medium 2
- Low 2
Disclosures per year
- 2021: 2
- 2022: 6
- 2023: 3
- 2024: 3
- 2025: 0
- 2026: 0
-
Access control issue in ezsystems/ezpublish-kernel this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.