BaseFortify

Publication date: 2025-11-25

Last updated on: 2025-12-01

Assigner: MITRE

Description

The Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoint is used for user data filtering but lacks proper server-side validation against the authenticated session. By manipulating the email parameter to an arbitrary value (e.g., [email protected]), an attacker can assume the session and gain full access to the target user's data and privileges. Also, if the email parameter is left blank, the application defaults to the first user in the list, who is typically the application administrator, resulting in an immediate Privilege Escalation to the highest level.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-25

Last Modified

2025-12-01

Generated

2026-07-06

AI Q&A

2025-11-25

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64062

Affected Vendors & Products

Vendor	Product	Version / Range
primakon	project_contract_management	1.0.18

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Primakon Pi Portal 1.0.18 at the /api/V2/pp_users?email endpoint, which is intended for user data filtering. However, it lacks proper server-side validation to verify that the email parameter corresponds to the authenticated session. An attacker can manipulate the email parameter to impersonate another user and gain full access to that user's data and privileges. Additionally, if the email parameter is left blank, the system defaults to the first user in the list, usually the administrator, allowing immediate privilege escalation to the highest level.

Impact Analysis

This vulnerability can allow an attacker to assume the identity of any user by manipulating the email parameter, leading to unauthorized access to sensitive user data and privileges. If exploited, it can result in privilege escalation to administrator level, potentially compromising the entire application and its data.

Hi! I’m here to help you understand CVE-2025-64062. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70