GHSA-w3j8-9p3j-3wjx

Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-67165

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	pagekit/pagekit	<= 1.0.18	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges. The project was archived as of December 1, 2023.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-67165 advisory
https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67165 web
https://github.com/pagekit/docs/blob/develop/user-interface/users.md#permissions web
https://github.com/pagekit/docs/blob/develop/user-interface/users.md#roles web
https://github.com/pagekit/pagekit package