PT-2025-48073 · Primakon · Pi Portal

Published 2025-11-25 · Updated 2025-12-01 · CVE-2025-64065

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Primakon Pi Portal version 1.0.18

Description The application’s /api/V2/pp udfv admin API endpoint does not adequately validate server-side requests. This allows authenticated users with low privileges to impersonate other users, including administrators, by sending a direct PATCH request. The issue stems from a broken function level authorization, where the function LoginAs does not verify the caller’s permissions, combined with an insecure design that allows session switching without requiring the target user’s password or an administrative token, only needing the user’s email address.

Recommendations Apply server-side validation to the /api/V2/pp udfv admin endpoint to ensure proper access control. Implement privilege checks within the LoginAs function to verify the caller’s authorization before allowing user impersonation. Secure the session switching mechanism to require appropriate authentication, such as the target user’s password or an administrative token.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-64065

Affected Products

Pi Portal

References · 7

• 🔥 https://github.com/n3k7ar91/Vulnerabilites/blob/main/Primakon/CVE-2025-64065.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-64065 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64065 · Vendor Advisory
• https://twitter.com/CVEnew/status/1993391928251978030 · Twitter Post
• https://twitter.com/dailycve/status/1995529424775602635 · Twitter Post
• https://t.me/cveNotify/144404 · Telegram Post
• https://primakon.com/rjesenja/primakon-pcm · Note