Primakon Pi Portal Unauthorized Data Exposure Vulnerability in User Management API

A vulnerability in the Primakon Pi Portal version 1.0.18 has been identified in the /api/v2/users endpoint. This vulnerability allows for unauthorized data exposure due to inadequate access control. Any authenticated user, regardless of privilege level, can send a GET request to this endpoint and access a complete list of all registered users within the application. Alarmingly, the API response includes password hashes, posing a significant security risk.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive user data, including password hashes, which could be used for further attacks such as password cracking or unauthorized account access.