Primakon Pi Portal Privilege Escalation Vulnerability

A vulnerability in the Primakon Pi Portal version 1.0.18 has been identified in the /api/v2/pp_users endpoint. This vulnerability arises from inadequate user permission checks, allowing low-level users to send PATCH requests that modify the PP_SECURITY_PROFILE_ID. By setting the PP_SECURITY_PROFILE_ID to 2, users can escalate their privileges to Administrator.

Impact

Exploitation of this vulnerability allows low-level users to gain Administrator privileges, leading to unauthorized access and control within the application.