BaseFortify

Publication date: 2025-11-25

Last updated on: 2025-12-01

Assigner: MITRE

Description

Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard user can exploit this flaw by sending direct HTTP requests to administrative endpoints, bypassing the UI restrictions. This allows the attacker to manipulate data outside their assigned scope, including: Unauthorized Account modification, modifying/deleting arbitrary user accounts and changing passwords by sending a direct request to the user management API endpoint; Confidential Data Access, accessing and downloading sensitive organizational documents via a direct request to the document retrieval API; Privilege escalation, This vulnerability can lead to complete compromise of data integrity and confidentiality, and Privilege Escalation by manipulating core system functions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-25

Last Modified

2025-12-01

Generated

2026-07-06

AI Q&A

2025-11-25

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64063

Affected Vendors & Products

Vendor	Product	Version / Range
primakon	project_contract_management	1.0.18

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Impact Analysis

The impact of this vulnerability includes unauthorized account modifications, deletion of arbitrary user accounts, unauthorized access to confidential organizational documents, and privilege escalation. This can lead to a complete compromise of data integrity and confidentiality within the affected system.

Executive Summary

This vulnerability in Primakon Pi Portal 1.0.18 occurs because the API endpoints do not enforce sufficient authorization checks. As a result, a standard user can bypass the user interface restrictions by sending direct HTTP requests to administrative API endpoints. This allows unauthorized actions such as modifying or deleting user accounts, changing passwords, accessing sensitive documents, and escalating privileges.

Hi! I’m here to help you understand CVE-2025-64063. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70