CVE-2005-4853: Ez Publish

High severity, CVSS 9.4. EPSS: 1.5% chance of exploitation in the next 30 days.

The default configuration of the forum package in eZ publish 3.5 before 3.5.5, 3.6 before 3.6.2, 3.7 before 3.7.0rc2, and 3.8 before 20050818 does not restrict edit permissions to a posting's owner, which allows remote authenticated users to edit arbitrary postings.

Affected products

• Ez Ez Publish: version 3.5.0 only; version 3.5.1 only; version 3.5.2 only; version 3.5.3 only; version 3.5.4 only

Published 2005-12-31. Last modified 2026-06-16.