CVE-2025-67165: 
PHP vulnerability analysis and mitigation

CVE-2025-67165 is an Insecure Direct Object Reference (IDOR) vulnerability in Pagekit CMS v1.0.18 that allows attackers to escalate privileges by manipulating user-controlled object references in the API. The vulnerability was discovered by Michal Biesiada and disclosed on December 17, 2025. It affects only Pagekit CMS version 1.0.18, which is also the final release of the now-archived project. It carries a CVSS v3.1 base score of 9.8 (Critical), assessed by CISA-ADP (GitHub Advisory, Feedly).

The root cause is an Authorization Bypass Through User-Controlled Key (CWE-639) in the /api/user/role/bulk API endpoint, which lacks server-side restrictions on modifying predefined system roles. An attacker with valid session cookies and an XSRF token can send a crafted POST request to rename or alter permissions for Pagekit's built-in roles — Anonymous, Authenticated, and Administrator — even though the GUI does not expose this functionality for default roles. The absence of server-side validation means the API accepts arbitrary role name and permission changes without verifying whether the target role is a protected system role. A proof-of-concept with screenshots demonstrating the exploitation steps has been published publicly (PoC Research).

Successful exploitation allows an attacker to modify system role names and permissions for Pagekit's core roles (Anonymous, Authenticated, Administrator), effectively enabling unauthorized privilege escalation to full administrative control. An attacker gaining administrative access could modify site content, alter user permissions across the entire CMS, access sensitive stored data, and maintain persistent control over the affected installation. Given that Pagekit is an archived project with no active maintenance, no upstream fix is expected from the vendor, leaving all v1.0.18 deployments permanently exposed (PoC Research, GitHub Advisory).

A public proof-of-concept with detailed screenshots is available on GitHub, published by the discoverer (PoC Research). The EPSS score is approximately 0.042%, indicating low but non-zero probability of exploitation in the near term. There is no confirmed evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid authenticated session with cookies and an XSRF token, which somewhat limits the attack surface compared to fully unauthenticated exploitation despite the Critical CVSS score.

1. Reconnaissance: Identify Pagekit CMS v1.0.18 installations via web fingerprinting tools (e.g., Wappalyzer, Shodan) or by checking the Pagekit version string in page source or HTTP headers.
2. Obtain a valid session: Register or log in to the Pagekit instance as any authenticated user to obtain valid session cookies and an XSRF token (obtainable from the application's frontend JavaScript or cookie jar).
3. Identify target role IDs: Query the Pagekit API or inspect the admin panel to enumerate existing role IDs for the predefined system roles (Anonymous, Authenticated, Administrator).
4. Craft malicious POST request: Send an authorized POST request to /api/user/role/bulk with the valid session cookies and XSRF token, including a payload that modifies the name or permissions of a target system role — for example, granting the Anonymous role Administrator-level permissions.
5. Achieve privilege escalation: After the API accepts the unauthorized modification, the attacker's account (or any user in the manipulated role) gains elevated privileges, including full administrative access to the CMS (PoC Research).

• Network: Unexpected POST requests to /api/user/role/bulk originating from non-administrative user sessions; API calls modifying role IDs corresponding to system roles (Anonymous, Authenticated, Administrator).
• Logs: Web server access logs showing POST requests to /api/user/role/bulk from low-privileged or anonymous user accounts; repeated API calls with varying role ID parameters.
• Application: Unexpected changes to the names or permissions of the default system roles (Anonymous, Authenticated, Administrator) visible in the Pagekit admin panel under Users > Roles or Permissions tabs.
• User Behavior: Low-privileged or newly registered accounts suddenly exhibiting administrative capabilities or accessing admin-restricted areas of the CMS.

Since Pagekit is an archived project (last release v1.0.18 in January 2020, repository archived December 2023), no vendor patch is expected. Organizations should consider migrating to an actively maintained CMS as the primary long-term remediation. As immediate workarounds: restrict network-level access to the /api/user/role/bulk endpoint via web server configuration (e.g., deny POST requests to that path for non-administrator sessions at the WAF or reverse proxy level); conduct a security audit of all user roles and permissions to detect unauthorized changes; and reset administrator credentials. The GitHub Advisory (GHSA-w3j8-9p3j-3wjx) should be reviewed for any community-contributed patches (GitHub Advisory).

The vulnerability was noted in automated CVE tracking feeds and aggregators including Vulners, VulDB, and CVEFeed shortly after disclosure. A brief post appeared on Bluesky via a CVE tracking account. No significant vendor statements exist given Pagekit's archived status, and no major security media coverage has been identified beyond standard CVE aggregation (Feedly).