CVE-2025-64065

In Primakon Pi Portal 1.0.18, API endpoints fail to enforce sufficient authorization checks. A standard user can send direct HTTP requests to administrative endpoints, bypassing UI restrictions, allowing unauthorized account modification, access to confidential documents, and privilege escalation.

API endpoints in Primakon Pi Portal 1.0.18 responsible for retrieving object-specific or filtered data fail to implement sufficient server-side validation to confirm that the requesting user is authorized to access the requested object or dataset. This vulnerability can be exploited via direct ID manipulation (IDOR) or by omitting the filtering parameter, leading to unauthorized exposure of sensitive personal and organizational information.

Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to adequately check user permissions before processing a PATCH request to modify PP_SECURITY_PROFILE_ID. Due to weak access controls, any low-level user can change their permission to Administrator by setting PP_SECURITY_PROFILE_ID=2.

Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability. The endpoint fails to implement any authorization checks, allowing unauthenticated attackers to perform POST requests to register new user accounts in the application's local database. This bypasses the intended security architecture, which relies on an external Identity Provider for initial user registration and assumes that internal user creation is an administrative-only function. This vector can also be chained with other vulnerabilities for privilege escalation and complete compromise of application. This specific request can be used to also enumerate already registered user accounts, aiding in social engineering or further targeted attacks.

The Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoint is used for user data filtering but lacks proper server-side validation against the authenticated session. By manipulating the email parameter to an arbitrary value, an attacker can assume the session and gain full access to the target user's data and privileges; leaving the parameter blank defaults to the first user (typically the administrator), resulting in immediate privilege escalation to the highest level.

The /api/v2/users endpoint in Primakon Pi Portal 1.0.18 is vulnerable to unauthorized data exposure due to deficient access control mechanisms. Any authenticated user, regardless of privilege level, can retrieve a complete list of all registered users, including password hashes.