CVE-2007-4493: Ez Publish

High severity, CVSS 10.0. EPSS: 1.8% chance of exploitation in the next 30 days.

eZ publish before 3.8.9, and 3.9 before 3.9.3, does not properly check permissions on module views that lack a policy function, which has unknown impact and attack vectors, as demonstrated by a vulnerability in the discount functionality in the shop module.

Affected products

• Ez Ez Publish: up to and including 3.8.8; version 3.9.0 only; version 3.9.1 only; version 3.9.2 only

Published 2007-08-23. Last modified 2026-06-16.