{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.0.18"}],"component":"pagekit/pagekit","cve_ids":["CVE-2025-67165"],"ecosystem":"Packagist","epss":0.00499,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-w3j8-9p3j-3wjx","id":"tcs_01M5KF9PD9B8574VKGC39YQ3ZW","modified_at":"2025-12-18T16:26:18.611295Z","published_at":"2025-12-17T18:31:34Z","references":["https://osv.dev/vulnerability/GHSA-w3j8-9p3j-3wjx","https://nvd.nist.gov/vuln/detail/CVE-2025-67165","https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67165","https://github.com/pagekit/docs/blob/develop/user-interface/users.md#permissions","https://github.com/pagekit/docs/blob/develop/user-interface/users.md#roles","https://github.com/pagekit/pagekit"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-w3j8-9p3j-3wjx","url":"https://osv.dev/vulnerability/GHSA-w3j8-9p3j-3wjx"}],"summary":"Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component"}