High · published November 25, 2025
⚡ A sneaky flaw in the Primakon Pi Portal API lets low-level users grant themselves Administrator rights—easy as sending a PATCH request! 🔥 Think of it like a hotel where anyone can forge their own keycard to the penthouse suite, bypassing all security checks—definitely not something you want happening! An attacker could exploit this oversight to elevate their access level, giving them complete control over security settings and user permissions. This could lead to unauthorized data access, manipulation, or even a full system compromise—yikes!
Think of it like a hotel where anyone can forge their own keycard to the penthouse suite, bypassing all security checks—definitely not something you want happening! The vulnerability lies in the /api/v2/pp_users endpoint that fails to perform proper permission checks before processing PATCH requests to modify the PP_SECURITY_PROFILE_ID. This allows unauthorized users to switch their profile to Administrator simply by including PP_SECURITY_PROFILE_ID=2 in their request body.
An attacker could exploit this oversight to elevate their access level, giving them complete control over security settings and user permissions. This could lead to unauthorized data access, manipulation, or even a full system compromise—yikes! Immediately patch the Primakon Pi Portal to version 1.0.19 to close this loophole. Additionally, review and strengthen permission checks on all critical endpoints to prevent similar exploits in the future. You've got this! With these steps, you're well on your way to securing your system. 🛡️