# CVE-2025-64063: Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests…

Source: https://junglewise.ai/threats/cve-2025-64063-primakon-pi-portal-1-0-18-api-endpoints-fail-to-enforce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-25  
License: CC BY 4.0 with a link back

CVE-2025-64063 · Severity: critical · CVSS 9.8 · Published 2025-11-25

Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard user can exploit this flaw by sending direct HTTP requests to administrative endpoints, bypassing the UI restrictions. This allows the attacker to manipulate data outside their assigned scope, including: Unauthorized Account modification, modifying/deleting arbitrary user accounts and changing passwords by sending a direct request to the user management API endpoint; Confidential Data Access, accessing and downloading sensitive organizational documents via a direct request to the document retrieval API; Privilege escalation, This vulnerability can lead to complete compromise of data integrity and confidentiality, and Privilege Escalation by manipulating core system functions.

Technologies: [Primakon Project Contract Management](https://junglewise.ai/threats/technologies/project-contract-management). Vendors: [Primakon](https://junglewise.ai/threats/vendors/primakon).

## Quick answers

**Is CVE-2025-64063 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64063 being exploited in the wild.

**How severe is CVE-2025-64063?** Critical severity, with a CVSS score of 9.8, published 25 November 2025.

**Which products and versions are affected?** Primakon Project Contract Management. The advisory does not name versions.

**Is there a fix for CVE-2025-64063?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-64063?** Check whether you run Primakon Project Contract Management. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Primakon Project Contract Management

## Related threats

- [Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data (e.g., user…](https://junglewise.ai/threats/cve-2025-64067-primakon-pi-portal-1-0-18-api-endpoints-responsible-for)
- [The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary server-side validation…](https://junglewise.ai/threats/cve-2025-64065-the-primakon-pi-portal-1-0-18-api-api-v2-pp-udfv-admin-endpoint)
- [Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to adequately check user permissions before processing a…](https://junglewise.ai/threats/cve-2025-64064-primakon-pi-portal-1-0-18-api-v2-pp-users-endpoint-fails-to)
- [The Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoint is used for user data filtering but lacks proper…](https://junglewise.ai/threats/cve-2025-64062-the-primakon-pi-portal-1-0-18-api-v2-pp-users-email-endpoint-is)