VULNERABILITY INTELLIGENCE
CVE-2026-57518
CVSS score8.8 HIGH
EPSS probability0.69%
CISA KEVNot currently listed
Published2026-06-26
Last modified2026-07-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to escalate privileges by assigning arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the 'system: manage packages' permission and then upload and install a malicious PHP package through the admin package installer to achieve remote code execution.
Weakness classification
- disclosure@vulncheck.com: CWE-862