# CVE-2026-57518: Pagekit CMS privilege escalation in UserApiController

Source: https://junglewise.ai/threats/cve-2026-57518-pagekit-cms-privilege-escalation-in-userapicontroller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-57518 · Severity: high · CVSS 8.8 · Published 2026-06-26

Pagekit CMS, a content management system, contains a security flaw that allows staff members with basic user-management permissions to grant themselves full administrative control. By elevating their own privileges, an attacker can upload malicious files to the server, leading to a complete takeover of the website and underlying server. This could result in the theft of sensitive data, website defacement, or the installation of ransomware.

Technologies: [Pagekit](https://junglewise.ai/threats/technologies/pagekit). Vendors: [Pagekit](https://junglewise.ai/threats/vendors/pagekit).

## Quick answers

**Is CVE-2026-57518 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57518 being exploited in the wild.

**How severe is CVE-2026-57518?** High severity, with a CVSS score of 8.8, published 26 June 2026.

**Which products and versions are affected?** Pagekit <= 1.0.18.

**Is there a fix for CVE-2026-57518?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57518 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-57518?** Check whether you run Pagekit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in Pagekit CMS 1.0.18 due to missing authorization checks in the `UserApiController::saveAction()` method. While the application explicitly blocks non-administrators from assigning the hard-coded 'Administrator' role (ID 3), it fails to validate the assignment of custom roles. An attacker with 'user: manage users' permissions can send a crafted POST request to `/api/user/{id}` to assign themselves a custom role containing the 'system: manage packages' permission. Once elevated, the attacker can use the admin package installer to upload and execute a malicious PHP package, resulting in full remote code execution (RCE). The project is currently archived and unmaintained.

## Affected products

- Pagekit Pagekit CMS <= 1.0.18

## Timeline

- 2026-06-26: disclosed: Vulnerability disclosed by Saidakbarxon Maqsudxonov
- 2026-06-26: advisory: CVE-2026-57518 published

## References

- [https://gist.github.com/sermikr0/6f0a67e9d101746fcdb04827de137847](https://gist.github.com/sermikr0/6f0a67e9d101746fcdb04827de137847)
- [https://www.vulncheck.com/advisories/pagekit-cms-privilege-escalation-via-userapicontroller](https://www.vulncheck.com/advisories/pagekit-cms-privilege-escalation-via-userapicontroller)

## Related threats

- [An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.](https://junglewise.ai/threats/cve-2025-67165-pagekit-cms-has-an-insecure-direct-object-reference-idor-in-its)
- [Pagekit CMS is vulnerable to OS Command Injection via Storage component](https://junglewise.ai/threats/cve-2025-67164-pagekit-cms-is-vulnerable-to-os-command-injection-via-storage)
- [Pagekit CMS password reset vulnerability in debug toolbar](https://junglewise.ai/threats/cve-2017-5594-pagekit-cms-password-reset-vulnerability-in-debug-toolbar)