GHSA-w3j8-9p3j-3wjxcritical9.8
Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component
Impact
An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
pagekit/pagekit Packagist
| Affected range | Recorded fix |
|---|---|
| Earlier releases through 1.0.18 (inclusive)Ecosystem versions | Not recorded |
Version evidence: OSV · GHSA-w3j8-9p3j-3wjx
View original version evidence (35 explicit versions)
Original source description
An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.
The project was archived as of December 1, 2023.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2025-67165
- Security advisory github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67165
- Source reference github.com/pagekit/docs/blob/develop/user-interface/users.md
- Source reference github.com/pagekit/docs/blob/develop/user-interface/users.md
- Source reference github.com/pagekit/pagekit