An Insecure Direct Object Reference flaw in Pagekit CMS allows unauthenticated attackers to escalate privileges and gain unauthorized control over the application.

This is an Insecure Direct Object Reference (IDOR) vulnerability that permits privilege escalation. The vulnerability is accessible to unauthenticated attackers, as identified by the CVSS vector PR:N and UI:N.

With a CVSS score of 9.8, this vulnerability poses an extreme risk to the integrity and confidentiality of the CMS. An attacker can manipulate object references to elevate their status to an administrator, leading to full site takeover, content manipulation, and potential server-side compromise.

Immediate Action: As no fix is currently available, administrators should restrict access to the CMS management interface to trusted IP addresses only.

Proactive Monitoring: Monitor user role changes and administrative access logs for unauthorized privilege modifications.

Compensating Controls: Implement strict network-level access controls or place the application behind a secure VPN or reverse proxy to limit exposure to the public internet.

Public Exploit Available: Yes — a public PoC exists via the researcher's repository (mbiesiad/vulnerability-research).

Given the availability of a proof-of-concept and the critical nature of the privilege escalation, this vulnerability requires immediate attention. If a vendor patch is not yet available, users must implement compensating network controls to isolate the management interface from unauthorized access.