CVE-2025-64064

Name of the Vulnerable Software and Affected Versions Primakon Pi Portal version 1.0.18

Description The /api/v2/pp users endpoint in Primakon Pi Portal does not properly verify user permissions when handling PATCH requests to modify the PP SECURITY PROFILE ID. This allows a low-level user to escalate privileges to Administrator by setting PP SECURITY PROFILE ID to 2 within the request body. The vulnerable parameter is PP SECURITY PROFILE ID.

Recommendations Apply access controls to the /api/v2/pp users endpoint to ensure proper permission checks before processing PATCH requests to modify the PP SECURITY PROFILE ID.