Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component

CRITICAL 9.8CVE-2025-67165 · GHSA-w3j8-9p3j-3wjx · Published 17/12/2025 · updated 13/10/2026

Package	Affected versions	Patched versions
pagekit/pagekit Packagist	`≤ 1.0.18`	No fix yet
pagekit pagekit	`= 1.0.18`	No fix yet

Description

An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.

The project was archived as of December 1, 2023.

NVD description

An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.