The Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoint is used for user data filtering but lacks proper server-side validation against the authenticated session. By manipulating the email parameter to an arbitrary value (e.g., otheruser@user.com), an attacker can assume the session and gain full access to the target user's data and privileges. Also, if the email parameter is left blank, the application defaults to the first user in the list, who is typically the application administrator, resulting in an immediate Privilege Escalation to the highest level.
References
| Link | Resource |
|---|---|
| https://github.com/n3k7ar91/Vulnerabilites/blob/main/Primakon/CVE-2025-64062.md | Third Party Advisory |
| https://www.primakon.com/rjesenja/primakon-pcm/ | Product |
Configurations
History
01 Dec 2025, 13:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/n3k7ar91/Vulnerabilites/blob/main/Primakon/CVE-2025-64062.md - Third Party Advisory | |
| References | () https://www.primakon.com/rjesenja/primakon-pcm/ - Product | |
| CPE | cpe:2.3:a:primakon:project_contract_management:1.0.18:*:*:*:*:*:*:* | |
| First Time |
Primakon project Contract Management
Primakon |
26 Nov 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CWE | CWE-285 |
25 Nov 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-25 18:15
Updated : 2025-12-01 13:25
NVD link : CVE-2025-64062
Mitre link : CVE-2025-64062
CVE.ORG link : CVE-2025-64062
JSON object : View
Products Affected
primakon
- project_contract_management
CWE
CWE-285
Improper Authorization