CVE-2008-6844: The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before...

Security readout for executives and security teams

An old eZ Publish registration page could let a remote user manipulate registration form fields and gain another user’s privileges. The risk matters mainly where legacy eZ Publish sites still expose /user/register. The source bundle does not show current active exploitation. Exposure is likely limited to legacy eZ Publish deployments with the registration view reachable. Internet-facing sites allowing public account registration are the highest concern. The affected product metadata is incomplete in the source bundle. Prioritize if any legacy eZ Publish site remains internet-facing. This is old, but privilege escalation through account registration can affect business-critical content systems if still deployed. Mitigation focus: Identify any eZ Publish instances and their exact versions.; Check eZSA-2008-003 and vendor guidance for branch-specific fixed releases.; Restrict or disable public /user/register if not required..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.