Open-source package vulnerability · Composer (PHP)
CVE-2025-67165: Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component
criticalCVSS 3.1 9.8GHSA-w3j8-9p3j-3wjx
An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges. The project was archived as of December 1, 2023.
Published Dec 17, 2025 · Updated Dec 18, 2025
Affected packages
pagekit/pagekit
- Ecosystem
- Composer (PHP)
- Affected
- <= 1.0.18
- Fixed in
- No patched version yet
- Check
composer show pagekit/pagekit
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.
The project was archived as of December 1, 2023.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-67165
- https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67165
- https://github.com/pagekit/docs/blob/develop/user-interface/users.md#permissions
- https://github.com/pagekit/docs/blob/develop/user-interface/users.md#roles
- https://github.com/pagekit/pagekit
- https://github.com/advisories/GHSA-w3j8-9p3j-3wjx
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology