# CVE-2025-64064: Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to adequately check user permissions before processing a…

Source: https://junglewise.ai/threats/cve-2025-64064-primakon-pi-portal-1-0-18-api-v2-pp-users-endpoint-fails-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-25  
License: CC BY 4.0 with a link back

CVE-2025-64064 · Severity: high · CVSS 8.8 · Published 2025-11-25

Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to adequately check user permissions before processing a PATCH request to modify the PP_SECURITY_PROFILE_ID. Because of weak access controls any low level user can use this API and change their permission to Administrator by using PP_SECURITY_PROFILE_ID=2 inside body of request and escalate privileges.

Technologies: [Primakon Project Contract Management](https://junglewise.ai/threats/technologies/project-contract-management). Vendors: [Primakon](https://junglewise.ai/threats/vendors/primakon).

## Quick answers

**Is CVE-2025-64064 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64064 being exploited in the wild.

**How severe is CVE-2025-64064?** High severity, with a CVSS score of 8.8, published 25 November 2025.

**Which products and versions are affected?** Primakon Project Contract Management. The advisory does not name versions.

**Is there a fix for CVE-2025-64064?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-64064?** Check whether you run Primakon Project Contract Management. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Primakon Project Contract Management

## Related threats

- [Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data (e.g., user…](https://junglewise.ai/threats/cve-2025-64067-primakon-pi-portal-1-0-18-api-endpoints-responsible-for)
- [The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary server-side validation…](https://junglewise.ai/threats/cve-2025-64065-the-primakon-pi-portal-1-0-18-api-api-v2-pp-udfv-admin-endpoint)
- [Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests…](https://junglewise.ai/threats/cve-2025-64063-primakon-pi-portal-1-0-18-api-endpoints-fail-to-enforce)
- [The Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoint is used for user data filtering but lacks proper…](https://junglewise.ai/threats/cve-2025-64062-the-primakon-pi-portal-1-0-18-api-v2-pp-users-email-endpoint-is)