https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 09:20:41 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-261918 EUVD-2026-261918 https://cve.radiocsirt.org/vuln/euvd-2026-261918 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64065 <p>The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH request, enabling them to impersonate any other arbitrary user, including application Administrators. This is due to a Broken Function Level Authorization failure (the function doesn&#39;t check the caller&#39;s privilege) compounded by an Insecure Design that permits a session switch without requiring the target user&#39;s password or an administrative token and only needs email of user.</p> <p>The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH request, enabling them to impersonate any other arbitrary user, including application Administrators. This is due to a Broken Function Level Authorization failure (the function doesn&#39;t check the caller&#39;s privilege) compounded by an Insecure Design that permits a session switch without requiring the target user&#39;s password or an administrative token and only needs email of user.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-64065 https://cve.radiocsirt.org/vuln/ghsa-rf7c-5mhx-3hf6 <p>The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH request, enabling them to impersonate any other arbitrary user, including application Administrators. This is due to a Broken Function Level Authorization failure (the function doesn&#39;t check the caller&#39;s privilege) compounded by an Insecure Design that permits a session switch without requiring the target user&#39;s password or an administrative token and only needs email of user.</p> <p>The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH request, enabling them to impersonate any other arbitrary user, including application Administrators. This is due to a Broken Function Level Authorization failure (the function doesn&#39;t check the caller&#39;s privilege) compounded by an Insecure Design that permits a session switch without requiring the target user&#39;s password or an administrative token and only needs email of user.</p> https://cve.radiocsirt.org/vuln/ghsa-rf7c-5mhx-3hf6