GitHub Advisoryadvisory · Packagist

GHSA-w3j8-9p3j-3wjx Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component

CRITICAL Published 2025-12-17 Modified 2025-12-18 Official page ↗
Aliases
CVE-2025-67165
Ecosystem
Packagist
Packages
pagekit/pagekit
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-639
Reviewed
2025-12-18

Affected packages

• Packagist pagekit/pagekit: <= 1.0.18 (no fix yet)

Description

An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges. The project was archived as of December 1, 2023.

Related

Alias · CVE (1)

  • CVE-2025-67165 An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges. vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References