CVE-2025-64063
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-25

Last updated on: 2025-12-01

Assigner: MITRE

Description
Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard user can exploit this flaw by sending direct HTTP requests to administrative endpoints, bypassing the UI restrictions. This allows the attacker to manipulate data outside their assigned scope, including: Unauthorized Account modification, modifying/deleting arbitrary user accounts and changing passwords by sending a direct request to the user management API endpoint; Confidential Data Access, accessing and downloading sensitive organizational documents via a direct request to the document retrieval API; Privilege escalation, This vulnerability can lead to complete compromise of data integrity and confidentiality, and Privilege Escalation by manipulating core system functions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-25
Last Modified
2025-12-01
Generated
2026-06-16
AI Q&A
2025-11-25
EPSS Evaluated
2026-06-15
NVD
CVE-2025-64063
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
primakon project_contract_management 1.0.18
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

The impact of this vulnerability includes unauthorized account modifications, deletion of arbitrary user accounts, unauthorized access to confidential organizational documents, and privilege escalation. This can lead to a complete compromise of data integrity and confidentiality within the affected system.

Executive Summary

This vulnerability in Primakon Pi Portal 1.0.18 occurs because the API endpoints do not enforce sufficient authorization checks. As a result, a standard user can bypass the user interface restrictions by sending direct HTTP requests to administrative API endpoints. This allows unauthorized actions such as modifying or deleting user accounts, changing passwords, accessing sensitive documents, and escalating privileges.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64063. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart