CVE-2025-64063

The Primakon Pi Portal version 1.0.18 is vulnerable to an improper authorization flaw (CWE-285 ) where API endpoints fail to enforce sufficient access controls. A standard user can bypass UI restrictions by sending direct HTTP requests to administrative endpoints. This allows for unauthorized acc...

CVE-2025-64065

The Primakon Pi Portal version 1.0.18 contains an access control failure in the /api/V2/pp_udfv_admin API endpoint. Due to a Broken Function Level Authorization and Insecure Design , the administrative LoginAs feature fails to verify the caller's privileges or require a target user's password or ...

CVE-2025-64064

The Primakon Pi Portal version 1.0.18 contains a privilege escalation vulnerability in the /api/v2/pp_users endpoint. Due to weak access controls , the system fails to adequately verify user permissions when processing a PATCH request intended to modify the PP_SECURITY_PROFILE_ID . An attacker wi...

CVE-2025-64067

The Primakon Pi Portal version 1.0.18 is vulnerable to an authorization bypass in its API endpoints responsible for retrieving object-specific or filtered data (e.g., user profiles, project records). The root cause is a lack of sufficient server-side validation to confirm that a requesting user i...

CVE-2025-64066

Primakon Pi Portal version 1.0.18 contains a Broken Access Control vulnerability in the REST /api/v2/user/register endpoint. The root cause is a failure to implement authorization checks, allowing unauthenticated attackers to perform POST requests to register new user accounts directly in the loc...

CVE-2025-64061

The Primakon Pi Portal version 1.0.18 is vulnerable to unauthorized data exposure via the /api/v2/users endpoint due to deficient access control mechanisms. Any authenticated user, including those with low privileges, can perform a GET request to this endpoint to retrieve a complete, unfiltered l...

CVE-2025-64062

The Primakon Pi Portal version 1.0.18 is vulnerable to an improper authorization flaw in the /api/V2/pp_users?email endpoint. The root cause is a lack of server-side validation against the authenticated session when filtering user data. An attacker can manipulate the email parameter to an arbitra...