NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘 Packagist
Not in CISA KEV

Ibexa DXP users with the Company admin role can assign any role to any userGHSA-g6jc-xrc3-4wwq

Fix: ibexa/admin-ui@e34abb0

GHSA-g6jc-xrc3-4wwq is a security vulnerability in ibexa/admin-ui. A fix is available for ibexa/admin-ui — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Dec 2, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐘ibexa/admin-ui

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.

The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistibexa/admin-ui≥ 4.2.0&&< 4.2.34.2.3composer require ibexa/admin-ui:^4.2.3

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ibexa/admin-ui, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update ibexa/admin-ui to 4.2.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-g6jc-xrc3-4wwq is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
O3 Security · Impact-Aware SCA

Is GHSA-g6jc-xrc3-4wwq in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
Ibexa DXP users with the Company admin role can assign…