https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-64067.htmlhttps://patchthecve.com/cve/CVE-2025-64067.htmlWed, 17 Jun 2026 09:53:46 +0000MEDIUM 5.3: Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data (e.g., user profiles, project records) fail to implement sufficient server-side validation to confirm that the requesting user is authorized to access the requested object or dataset. This vulnerabilihttps://patchthecve.com/cve/CVE-2025-64065.htmlhttps://patchthecve.com/cve/CVE-2025-64065.htmlWed, 17 Jun 2026 09:53:46 +0000HIGH 8.8: The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH rehttps://patchthecve.com/cve/CVE-2025-64064.htmlhttps://patchthecve.com/cve/CVE-2025-64064.htmlWed, 17 Jun 2026 09:53:46 +0000HIGH 8.8: Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to adequately check user permissions before processing a PATCH request to modify the PP_SECURITY_PROFILE_ID. Because of weak access controls any low level user can use this API and change their permission to Administrator by using PP_SECURITYhttps://patchthecve.com/cve/CVE-2025-64063.htmlhttps://patchthecve.com/cve/CVE-2025-64063.htmlWed, 17 Jun 2026 09:53:45 +0000CRITICAL 9.8: Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard user can exploit this flaw by sending direct HTTP requests to administrative endpoints, bypassing the UI restrictions. This allows the attacker to manipulate dathttps://patchthecve.com/cve/CVE-2025-64066.htmlhttps://patchthecve.com/cve/CVE-2025-64066.htmlWed, 17 Jun 2026 09:53:46 +0000HIGH 8.6: Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability. The endpoint fails to implement any authorization checks, allowing unauthenticated attackers to perform POST requests to register new user accounts in the application's local database. Thttps://patchthecve.com/cve/CVE-2025-64062.htmlhttps://patchthecve.com/cve/CVE-2025-64062.htmlWed, 17 Jun 2026 09:53:45 +0000HIGH 8.8: The Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoint is used for user data filtering but lacks proper server-side validation against the authenticated session. By manipulating the email parameter to an arbitrary value (e.g., otheruser@user.com), an attacker can assume the session and gain fhttps://patchthecve.com/cve/CVE-2025-64061.htmlhttps://patchthecve.com/cve/CVE-2025-64061.htmlWed, 17 Jun 2026 09:53:45 +0000MEDIUM 4.3: Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access control mechanisms. Any authenticated user, regardless of their privilege level (including standard or low-privileged users), can make a GET request to this endpoint and retrieve a co