CVE-2025-67165
CVE-2025-67165
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.
CVSS 9.8 · Critical · EPSS 0.5%
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
pagekit/pagekit Packagist
- Versions
- 0.10.0
- 0.10.1
- 0.10.2
- 0.10.3
- 0.10.4
- 0.11.0
- 0.11.1
- 0.11.2
- 0.11.3
- 0.8.8
- 0.9.0
- 0.9.1
- 0.9.2
- 0.9.3
- 0.9.4
- 0.9.5
- 1.0.0
- 1.0.1
- 1.0.10
- 1.0.11
- 1.0.12
- 1.0.13
- 1.0.14
- 1.0.15
- 1.0.16
- 1.0.17
- 1.0.18
- 1.0.2
- 1.0.3
- 1.0.4
- 1.0.5
- 1.0.6
- 1.0.7
- 1.0.8
- 1.0.9
- Affected ranges
- ECOSYSTEM: ≤ 1.0.18
No fix published
Original sources
- https://github.com/pagekit/pagekit
- https://github.com/pagekit/docs/blob/develop/user-interface/users.md#roles
- https://github.com/pagekit/docs/blob/develop/user-interface/users.md#permissions
- https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67165
- https://nvd.nist.gov/vuln/detail/CVE-2025-67165