CVE-2025-64062

The Primakon Pi Portal version 1.0.18 is vulnerable to an improper authorization flaw in the /api/V2/pp_users?email endpoint. The root cause is a lack of server-side validation against the authenticated session when filtering user data. An attacker can manipulate the email parameter to an arbitra...