CVE-2025-64063
CriticalSummary
In Primakon Pi Portal 1.0.18, API endpoints fail to enforce sufficient authorization checks. A standard user can send direct HTTP requests to administrative endpoints, bypassing UI restrictions, allowing unauthorized account modification, access to confidential documents, and privilege escalation.
Risk Assessment
An attacker can take over user accounts, access sensitive data, and escalate privileges, leading to compromise of data integrity and confidentiality.
Recommendation
Implement proper authorization controls on all API endpoints and restrict access to administrative functions.
Original NVD description (English source)
Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard user can exploit this flaw by sending direct HTTP requests to administrative endpoints, bypassing the UI restrictions. This allows the attacker to manipulate data outside their assigned scope, including: Unauthorized Account modification, modifying/deleting arbitrary user accounts and changing passwords by sending a direct request to the user management API endpoint; Confidential Data Access, accessing and downloading sensitive organizational documents via a direct request to the document retrieval API; Privilege escalation, This vulnerability can lead to complete compromise of data integrity and confidentiality, and Privilege Escalation by manipulating core system functions.