CVE-2025-64066
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability. The endpoint fails to implement any authorization checks, allowing unauthenticated attackers to perform POST requests to register new user accounts in the application's local database. This bypasses the intended security architecture, which relies on an external Identity Provider for initial user registration and assumes that internal user creation is an administrative-only function. This vector can also be chained with other vulnerabilities for privilege escalation and complete compromise of application. This specific request can be used to also enumerate already registered user accounts, aiding in social engineering or further targeted attacks.
Risk Assessment
An attacker can create unauthorized accounts, enumerate existing users, and chain this vulnerability with others for privilege escalation and complete application compromise. The risk affects Primakon Pi Portal 1.0.18 deployments.
Recommendation
Update Primakon Pi Portal to a version containing the fix or enforce authorization checks on the /api/v2/user/register endpoint. Restrict access to the registration endpoint and monitor for unusual account creation attempts.
Other vulnerabilities in Primakon Pi Portal
See all- CVE-2025-64063Critical
In Primakon Pi Portal 1.0.18, API endpoints fail to enforce sufficient authorization checks. A standard user can send direct HTTP requests to administrative endpoints, bypassing UI restrictions, allowing unauthorized account modification, access to confidential documents, and privilege escalation.
- CVE-2025-64067Medium
API endpoints in Primakon Pi Portal 1.0.18 responsible for retrieving object-specific or filtered data fail to implement sufficient server-side validation to confirm that the requesting user is authorized to access the requested object or dataset. This vulnerability can be exploited via direct ID manipulation (IDOR) or by omitting the filtering parameter, leading to unauthorized exposure of sensitive personal and organizational information.
- CVE-2025-64065High
Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint fails to perform necessary server-side validation. The LoginAs or user impersonation feature is vulnerable to an access control failure, allowing any authenticated low-privileged user to impersonate any other user, including administrators.
- CVE-2025-64064High
Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to adequately check user permissions before processing a PATCH request to modify PP_SECURITY_PROFILE_ID. Due to weak access controls, any low-level user can change their permission to Administrator by setting PP_SECURITY_PROFILE_ID=2.
- CVE-2025-64062High
The Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoint is used for user data filtering but lacks proper server-side validation against the authenticated session. By manipulating the email parameter to an arbitrary value, an attacker can assume the session and gain full access to the target user's data and privileges; leaving the parameter blank defaults to the first user (typically the administrator), resulting in immediate privilege escalation to the highest level.
- CVE-2025-64061Medium
The /api/v2/users endpoint in Primakon Pi Portal 1.0.18 is vulnerable to unauthorized data exposure due to deficient access control mechanisms. Any authenticated user, regardless of privilege level, can retrieve a complete list of all registered users, including password hashes.
Original NVD description (English source)
Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability. The endpoint fails to implement any authorization checks, allowing unauthenticated attackers to perform POST requests to register new user accounts in the application's local database. This bypasses the intended security architecture, which relies on an external Identity Provider for initial user registration and assumes that internal user creation is an administrative-only function. This vector can also be chained with other vulnerabilities for privilege escalation and complete compromise of application. This specific request can be used to also enumerate already registered user accounts, aiding in social engineering or further targeted attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS