Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
FOSUserBundle User Data Can Be Changed by Other Users
published 2 years ago
Summary
FOSUserBundle versions before 1.2.1 allow other users to change your user data if they know your username. This is a security risk, especially if you allow users to change their own user information. To fix this, update FOSUserBundle to version 1.2.1 or later.
What to do
- Update friendsofsymfony user-bundle to version 1.2.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | friendsofsymfony | user-bundle |
>= 1.2.0, < 1.2.1 Fix: upgrade to 1.2.1
|
Original advisory text
FOSUserBundle User Identity Validation Vulnerability
Versions of FOSUserBundle prior to 1.2.1 have been found to be vulnerable to a security issue related to user identity validation. Specifically, user refreshing was performed using the primary key instead of the username, leading to a potential security risk if a user is allowed to change their username. The fix in version 1.2.1 addresses this issue by loading the user using the primary key during refreshing.
References
Type
CWE-285Improper Authorization
Timeline
Published15 May 2024
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-8wx3-8m4x-g5h4 · GHSA
Track software like this
Free during beta