Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Primakon Pi Portal 1.0.18: Authorized Users Can Take Over Admin Accounts

CVE-2025-64065 · published 11 months ago
Summary

An authenticated user can take over any user account, including admin accounts, by sending a specific request to the API. This can happen because the system doesn't properly check who is making the request and only requires the target user's email to impersonate them. Update to a newer version of the software to prevent unauthorized access.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
primakon project_contract_management 1.0.18
cpe:2.3:a:primakon:project_contract_management:1.0.18:*:*:*:*:*:*:*
Original advisory text
The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a acce...
The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH request, enabling them to impersonate any other arbitrary user, including application Administrators. This is due to a Broken Function Level Authorization failure (the function doesn't check the caller's privilege) compounded by an Insecure Design that permits a session switch without requiring the target user's password or an administrative token and only needs email of user.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-285Improper Authorization
Timeline
Published25 Nov 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-64065 · NVD
Track software like this
Free during beta