PT-2025-48066 · Primakon · Primakon Pi Portal

Published 2025-11-25 · Updated 2025-12-01 · CVE-2025-64066

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Primakon Pi Portal version 1.0.18

Description The /api/v2/user/register endpoint in Primakon Pi Portal is susceptible to a Broken Access Control issue. The endpoint does not enforce authorization checks, enabling unauthenticated attackers to submit POST requests to create new user accounts directly in the application’s local database. This circumvents the expected security design, which depends on an external Identity Provider for initial user registration and assumes internal user creation is restricted to administrators. This issue can potentially be combined with other weaknesses to escalate privileges and fully compromise the application. The endpoint can also be used to enumerate existing user accounts, which could facilitate social engineering or more focused attacks.

Recommendations Implement proper authorization checks on the /api/v2/user/register endpoint to ensure only authenticated and authorized users can create new accounts.

Exploit

Fix

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-64066

Affected Products

Primakon Pi Portal

References · 8

• 🔥 https://github.com/n3k7ar91/Vulnerabilites/blob/main/Primakon/CVE-2025-64066.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-64066 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64066 · Vendor Advisory
• https://t.me/CVEtracker/38212 · Telegram Post
• https://twitter.com/dailycve/status/1995534235801976881 · Twitter Post
• https://primakon.com/rjesenja/primakon-pcm · Note
• https://t.me/cveNotify/144399 · Telegram Post
• https://twitter.com/CVEnew/status/1993385795399700873 · Twitter Post