Users with the Company admin role can assign any role to any user

Critical

glye published GHSA-pcpm-vc4v-cmvx

Nov 10, 2022

Package

ezsystems/ezplatform-admin-ui (Composer)

Affected versions

v1.5.*, v2.3.*

Patched versions

v1.5.29, v2.3.26

Description

Please see https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips