Ibexa vulnerabilities
We track 3 vulnerabilities in Ibexa products across 4 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on March 6, 2026.
Latest Ibexa vulnerabilities
- 7.5 High severity
Ez Platform: Improper Access Control
Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x allows unauthenticated attackers to access sensitive data via enumerating object IDs.
- 8.5 High severity
user: Unverified Password Change
Ibexa is a composable end-to-end DXP (Digital Experience Platform). Versions 5.0.0-beta1 through 5.0.3 do not have password validation. During the transition from v4 to v5 an error was introduced into validation code which causes the validation of the previous
- 7.2 High severity
fieldtype-richtext: Improper Neutralization of Input During Web Page Generation
Ibexa RichText Field Type is a Field Type for supporting rich formatted text stored in a structured XML format. In versions on the 4.6 branch prior to 4.6.10, the validator for the RichText fieldtype blocklists `javascript:` and `vbscript:` in links to prevent