CVE-2025-67165: Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component

December 17, 2025 (updated December 18, 2025)

An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.

The project was archived as of December 1, 2023.

References

github.com/advisories/GHSA-w3j8-9p3j-3wjx
github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67165
github.com/pagekit/docs/blob/develop/user-interface/users.md
github.com/pagekit/docs/blob/develop/user-interface/users.md
github.com/pagekit/pagekit
nvd.nist.gov/vuln/detail/CVE-2025-67165

Code Behaviors & Features

Detect and mitigate CVE-2025-67165 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →