critical9.8
CVE-2025-67165
Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component
Impact
An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges. The project was archived as of December 1, 2023.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | pagekit/pagekit | <= 1.0.18 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pagekit | Pagekit | Version 1.0.18 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67165
- https://github.com/pagekit/docs/blob/develop/user-interface/users.md#permissions
- https://github.com/pagekit/docs/blob/develop/user-interface/users.md#roles
- https://github.com/pagekit/pagekit
- https://github.com/advisories/GHSA-w3j8-9p3j-3wjx
- https://nvd.nist.gov/vuln/detail/CVE-2025-67165