Read the docs
TI-2025-39531 Aliases CVE-2025-64067GHSA-mf87-r67v-2m82

Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or…

Priority LOW 30CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-639.

Summary

Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data (e.g., user profiles, project records) fail to implement sufficient server-side validation to confirm that the requesting user is authorized to access the requested object or dataset. This vulnerability can be exploited in two ways: Direct ID manipulation and IDOR, by changing an ID parameter (e.g., user_id, project_id) in the request, an attacker can access the object and data belonging to another user; and filter Omission, by omitting the filtering parameter entirely, an attacker can cause the endpoint to return an entire unfiltered dataset of all stored records for all users. This flaw leads to the unauthorized exposure of sensitive personal and organizational information.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00248 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:primakon:project_contract_management:1.0.18:*:*:*:*:*:*:*1.0.18VulnerablePrimakon
  • cpe:2.3:a:primakon:project_contract_management:1.0.18:*:*:*:*:*:*:* Versions 1.0.18 Vulnerable ·Primakon

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-64067
  2. 2026-10-03 Alias added: GHSA-mf87-r67v-2m82

References

Advisory 1

Other 1

  • TI-2025-39530 Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken… CVSS 3.1HIGH 8.6
  • TI-2025-39527 Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks… CVSS 3.1CRITICAL 9.8
  • TI-2025-39529 The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform… CVSS 3.1HIGH 8.8
  • TI-2025-39528 Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to adequately check user… CVSS 3.1HIGH 8.8
  • TI-2025-39526 The Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoint is used for user data… CVSS 3.1HIGH 8.8
  • TI-2025-39525 Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data… CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences