CVE-2025-67165
Critical · 9.8Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component
CVSS
9.8
EPSS
0.5%
Published
Dec 17, 2025
CISA due date
—
The record
An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges. The project was archived as of December 1, 2023.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | pagekit/pagekit | 0 | No fix |
Related vulnerabilities
- GHSA-w3j8-9p3j-3wjx Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component Same vulnerability
- GHSA-m4f2-xpfq-h97v Pagekit CMS is vulnerable to OS Command Injection via Storage component Also affects pagekit/pagekit
- CVE-2025-67164 Pagekit CMS is vulnerable to OS Command Injection via Storage component Also affects pagekit/pagekit
- CVE-2026-13319 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before… CWE-639
- CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-639
- CVE-2026-105755 vLLM is an inference and serving engine for large language models. CWE-639
- CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-639
- CVE-2026-62140 Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <=… CWE-639