CVE-2022-48367: Ibexa Digital Experience Platform

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.

Affected products

• Ibexa Digital Experience Platform: from 3.3.0, before 3.3.18 (fixed in 3.3.18); from 4.0.0, before 4.0.5 (fixed in 4.0.5); from 4.1.0, before 4.1.2 (fixed in 4.1.2)
• Ibexa Ez Platform Kernel: from 1.3.0, before 1.3.17 (fixed in 1.3.17); from 7.5.0, before 7.5.28 (fixed in 7.5.28)
• Ibexa Ezplatform-HTTP-Cache-Fastly: from 1.1.0, before 1.1.9 (fixed in 1.1.9); from 2.0.0, before 2.0.11 (fixed in 2.0.11)
• Ibexa Fastly: from 4.0.0, before 4.0.5 (fixed in 4.0.5); from 4.1.0, before 4.1.2 (fixed in 4.1.2)
• Ibexa Kernel: from 4.0.0, before 4.0.7 (fixed in 4.0.7); from 4.1.0, before 4.1.4 (fixed in 4.1.4)

Published 2023-03-12. Last modified 2026-06-17.