CVE-2022-48365

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.

• CWE-269
• CWE-269

• https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltipsVendor Advisory
• https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-8h83-chh2-fchpVendor Advisory
• https://github.com/ezsystems/ezpublish-kernel/commit/957e67a08af2b3265753f9763943e8225ed779abPatch
• https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-99r3-xmmq-7q7gVendor Advisory
• https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltipsVendor Advisory
• https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-8h83-chh2-fchpVendor Advisory
• https://github.com/ezsystems/ezpublish-kernel/commit/957e67a08af2b3265753f9763943e8225ed779abPatch
• https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-99r3-xmmq-7q7gVendor Advisory

Published

Mar 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-4836The Breadcrumb WordPress plugin before 1.5.33 does not valid…5.4
• CVE-2022-48360The facial recognition module has a vulnerability in file pe…7.5
• CVE-2022-48361The Always On Display (AOD) has a path traversal vulnerabili…5.3
• CVE-2022-48362Zoho ManageEngine Desktop Central and Desktop Central MSP be…8.8
• CVE-2022-48363In MPD before 0.23.8, as used on Automotive Grade Linux and …7.5
• CVE-2022-48364The undo_mark_statuses_as_sensitive method in app/services/a…4.3
• CVE-2022-48366An issue was discovered in eZ Platform Ibexa Kernel before 1…3.7
• CVE-2022-48367An issue was discovered in eZ Publish Ibexa Kernel before 7.…9.8
• CVE-2022-48368In audio service, there is a possible missing permission che…7.8
• CVE-2022-48369In audio service, there is a possible missing permission che…7.8
• CVE-2022-4837The CPO Companion WordPress plugin before 1.1.0 does not val…5.4
• CVE-2022-48370In dialer service, there is a possible missing permission ch…5.5