Saidakbarxon Maqsudxonov

**Name of the Vulnerable Software and Affected Versions** Pagekit CMS version 1.0.18 **Description** An issue exists where authenticated users possessing the 'user: manage users' permission can escalate their privileges. This occurs due to missing authorization checks within the `saveAction()` function of the `UserApiController`. An attacker can exploit this to assign themselves a custom role with the 'system: manage packages' permission, subsequently allowing them to upload and install a malicious PHP package via the admin package installer to achieve remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.