PT-2025-52292 · Unknown · Control Id Panel

Published 2025-12-18 · Updated 2025-12-19 · CVE-2025-64400

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Control Panel (affected versions not specified)

Description The Control Panel software has an issue with its API for pre-registering users into an enrollment and organization before their initial login. The API used for user creation verifies that the requesting account has edit permissions on the enrollment-level user directory. However, it lacks a separate verification to ensure the enrollment editor has access to, or membership in, the organization to which they are adding a user. The API endpoint responsible for user creation does not adequately validate organizational access rights. The vulnerable parameter is the organization identifier used during user creation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-64400

Affected Products

Control Id Panel

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-64400 · Security Note
• https://twitter.com/CVEnew/status/2002117807899643907 · Twitter Post
• https://palantir.safebase.us/?tcuUid=52a9fd2f-1868-48cb-af01-93c589160e19 · Note