Primakon Pi Portal Broken Object-Level Authorization Vulnerability

A vulnerability exists in Primakon Pi Portal version 1.0.18 within API endpoints that retrieve object-specific or filtered data, such as user profiles and project records. These endpoints lack adequate server-side validation to ensure that users are authorized to access the requested data. This vulnerability can be exploited through direct ID manipulation and Insecure Direct Object Reference (IDOR) by altering ID parameters to access another user's data. Additionally, by omitting filtering parameters, an attacker can obtain unfiltered datasets containing sensitive personal and organizational information.

Impact

Exploitation of this vulnerability results in unauthorized access to and exposure of sensitive data, including personal and organizational information, from other users.