PT-2025-48074 · Primakon · Pi Portal

Published 2025-11-25 · Updated 2025-12-01 · CVE-2025-64067

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Primakon Pi Portal version 1.0.18

Description API endpoints responsible for retrieving object-specific or filtered data, such as user profiles and project records, do not adequately validate server-side authorization. This allows unauthorized access to objects and data belonging to other users through direct ID manipulation and filter omission. Specifically, modifying the user id or project id parameter in a request can grant access to another user's data. Omitting a filtering parameter can result in the return of an unfiltered dataset containing records for all users. This leads to the exposure of sensitive personal and organizational information.

Recommendations Implement robust server-side validation to confirm that the requesting user is authorized to access the requested object or dataset. Ensure that all API endpoints properly enforce access controls based on user roles and permissions. Implement proper filtering mechanisms to prevent the retrieval of unfiltered datasets.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-64067

Affected Products

Pi Portal

References · 8

• 🔥 https://github.com/n3k7ar91/Vulnerabilites/blob/main/Primakon/CVE-2025-64067.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-64067 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64067 · Security Note
• https://twitter.com/dailycve/status/1995533830812209170 · Twitter Post
• https://twitter.com/CVEnew/status/1993391929380258219 · Twitter Post
• https://primakon.com/rjesenja/primakon-pcm · Note
• https://t.me/cveNotify/144405 · Telegram Post
• https://t.me/CVEtracker/38216 · Telegram Post