# Security Bulletin 2014 - 003 published

**URL:** <https://forum.oxid-esales.com/t/security-bulletin-2014-003-published/70330>\
**Category:** OXID Announcements\
**Tags:** security\
**Created:** [August 12, 2014, 11:44pm UTC](https://forum.oxid-esales.com/t/security-bulletin-2014-003-published/70330 "2014-08-12T23:44:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hebsacker](https://forum.oxid-esales.com/user_avatar/forum.oxid-esales.com/hebsacker/32/45_2.png) [@Hebsacker](https://forum.oxid-esales.com/u/Hebsacker)\
**Post date:** [August 12, 2014, 11:44pm UTC](https://forum.oxid-esales.com/t/security-bulletin-2014-003-published/70330/1 "2014-08-12T23:44:39Z")

</div>

Hi all

As announced with last patch release, the security bulletin 2014-003 was published today:

> **[Security bulletin: 2014-003 • OXIDforge](https://oxidforge.org/en/security-bulletin-2014-003.html)**
>
> CVE-2014-4919: A possibility to assign to any user group, except admin group, without admin confirmation has been found in OXID eShop all editions, all former versions.

The issue has been fixed with OXID eShop Enterprise Edition 5.1.7 and Community/Professional Edition 4.8.7.

> **[OXID eShop version 4.8.7 (CE + PE) & 5.1.7 (EE) • OXIDforge](https://oxidforge.org/en/oxid-eshop-version-4-8-7-ce-pe-5-1-7-ee.html)**
>
> General hints for this package Runs on PHP 5.4 and PHP 5.3. Might run on PHP 5.2 (not tested any longer). This patch includes one security fix. Please update as soon as possible. The security bulletin for this issue (2014-003) will be published and...

If there are any problems for you to update your shop immediately, the workaround within the bulletin can help you out.

---

<div class="post-metadata">

**Author:** ![Hebsacker](https://forum.oxid-esales.com/user_avatar/forum.oxid-esales.com/hebsacker/32/45_2.png) [@Hebsacker](https://forum.oxid-esales.com/u/Hebsacker)\
**Post date:** [August 13, 2014, 7:29am UTC](https://forum.oxid-esales.com/t/security-bulletin-2014-003-published/70330/2 "2014-08-13T07:29:50Z")

</div>

By the way, the fix has been added as well to the patch 5.0.13 / 4.7.13

> **[OXID eShop version 4.7.13 (CE + PE) & 5.0.13 (EE)](https://oxidforge.org/en/oxid-eshop-version-4-7-13-ce-pe-5-0-13-ee.html)**
>
> Release Notes OXID eShop version 4.7.13 (CE + PE) & 5.0.13 (EE)

---

<div class="post-metadata">

**Author:** ![system](https://forum.oxid-esales.com/user_avatar/forum.oxid-esales.com/system/32/4245_2.png) [@system](https://forum.oxid-esales.com/u/system)\
**Post date:** [July 13, 2026, 8:35pm UTC](https://forum.oxid-esales.com/t/security-bulletin-2014-003-published/70330/3 "2026-07-13T20:35:52Z")

</div>