Pagekit CMS CVE-2025-67165

The attacker must reach the Pagekit CMS application over the network and manipulate a user-controlled direct object reference (the user/role/permission identifier governing Pagekit's roles-and-permissions model documented in users.md#permissions and users.md#roles) to assign themselves elevated rights. Although the NVD vector states PR:N, the IDOR-to-privilege-escalation nature strongly implies a valid authenticated low-privilege session is required to issue the authorization-bypass request - this authentication prerequisite is the primary limiting factor and should be confirmed with the exploit POC. Exploitation is constrained to deployments running the specific vulnerable version Pagekit 1.0.18; the product is niche and largely unmaintained, further limiting real-world exposure.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 9.8 Critical, implying remote, unauthenticated, no-interaction exploitation with full C/I/A impact. However, this conflicts with the vulnerability class: an IDOR (CWE-639, Authorization Bypass Through User-Controlled Key) used to escalate privileges almost always requires an existing authenticated low-privilege account to manipulate a direct object reference (e.g., a user ID or role field) - verify PR with the vendor, as PR:N appears inconsistent with a privilege-escalation IDOR. The exploitation signals are mixed and point to lower real-world urgency than the 9.8 suggests: EPSS is only 0.50% (41st percentile), this CVE is NOT on the CISA KEV list (no confirmed active exploitation), and while public exploit code exists in a security researcher's GitHub repo, POC availability is distinct from active exploitation. Net assessment: a genuine, high-impact authorization flaw with a public POC, but mitigated by a niche affected product (Pagekit CMS), low EPSS, no KEV listing, and a likely authentication prerequisite - treat as a real but non-emergency priority, prioritizing patching only where Pagekit 1.0.18 is actually deployed.

A registered low-privilege Pagekit user authenticates to the CMS and sends a request that references another object (such as a user/role identifier) they should not control, exploiting the IDOR to grant themselves administrator permissions. Publicly available exploit code exists in a GitHub research repository, lowering the skill required; because the CVSS vector lists AV:N/AC:L, the manipulation is performed over the network with low complexity once access to the application is obtained.