Primakon Pi Portal User Data Access Vulnerability via Email Parameter Manipulation

A vulnerability in the Primakon Pi Portal version 1.0.18 allows for unauthorized access to user data through the manipulation of the email parameter in the /api/V2/pp_users endpoint. The lack of proper server-side validation enables an attacker to impersonate another user and access their data and privileges. Additionally, leaving the email parameter blank defaults to the first user in the list, usually the administrator, leading to unauthorized privilege escalation.

Impact

Exploitation of this vulnerability allows for account takeover by accessing another user's data and privileges. If the email parameter is left blank, the first user in the list, typically the administrator, is accessed, resulting in privilege escalation to the highest level.