CVE-2026-57518: Pagekit CMS Privilege Escalation Flaw

CVE-2026-57518 Overview

CVE-2026-57518 is a privilege escalation vulnerability in Pagekit CMS 1.0.18. The flaw resides in the UserApiController::saveAction() method, which lacks authorization checks when processing role assignments. Authenticated users holding the user: manage users permission can assign arbitrary custom roles to themselves. By granting themselves a role containing the system: manage packages permission, attackers upload a malicious PHP package via the admin package installer to achieve remote code execution. The weakness is categorized as Missing Authorization [CWE-862].

Critical Impact
A low-privileged authenticated user can escalate to administrative rights and execute arbitrary PHP code on the underlying server, resulting in full application compromise.

Affected Products

Pagekit CMS 1.0.18
Pagekit CMS deployments exposing the admin API to authenticated users
Web applications using the UserApiController component from Pagekit

Discovery Timeline

2026-06-26 - CVE-2026-57518 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-57518

Vulnerability Analysis

The vulnerability originates in Pagekit's user management API. The UserApiController::saveAction() handler processes updates to user records, including the roles assigned to each account. The handler validates that the caller has the user: manage users permission but performs no additional checks on which roles the caller is permitted to assign. An attacker with this single permission can therefore write any role identifier into their own account record.

Exploitation is a two-stage chain. First, the attacker crafts or selects a custom role that includes the system: manage packages permission and assigns it to themselves through the vulnerable endpoint. Second, they use the admin package installer to upload a Pagekit package containing arbitrary PHP code. The installer executes the package during installation, giving the attacker code execution in the web server context. Because the chain begins with an already-privileged administrative permission, tenants that delegate user management to non-administrators are the primary risk population.

Root Cause

The root cause is missing authorization enforcement in UserApiController::saveAction(). The controller does not verify that the caller is permitted to grant the specific roles being written, treating any authenticated user: manage users holder as authorized to assign every defined role, including those exceeding their own privilege level.

Attack Vector

The attack vector is network-based and requires authentication with the user: manage users permission. No user interaction is required. Exploitation proceeds through standard HTTP requests to the Pagekit admin API endpoint, followed by a package upload through the admin interface. Refer to the VulnCheck Advisory for Pagekit CMS and the GitHub Gist Exploit Code for the request sequence and payload structure.

Detection Methods for CVE-2026-57518

Indicators of Compromise

POST or PUT requests to /api/user/* endpoints where the request body modifies the roles field of the requesting user's own account.
Newly created or modified custom roles that include the system: manage packages permission shortly before a package installation event.
Package upload or install actions in the Pagekit admin log initiated by accounts that previously held only user: manage users.
Unexpected .php files written under Pagekit's packages/ or extension directories following an install event.

Detection Strategies

Audit Pagekit application logs for role changes where the acting user identifier equals the target user identifier.
Correlate role assignment events with subsequent package installer activity from the same session or IP address.
Monitor web server logs for HTTP requests to the package installer endpoint and inspect uploaded archive contents.
Alert on the creation of custom roles that combine user-management and system-management permissions.

Monitoring Recommendations

Enable verbose Pagekit audit logging for user, role, and package operations and forward events to a central SIEM.
Watch file integrity monitoring for new PHP files appearing in the Pagekit installation tree outside of scheduled maintenance windows.
Track outbound network connections initiated by the PHP process, which may indicate a webshell installed via the package installer.

How to Mitigate CVE-2026-57518

Immediate Actions Required

Restrict the user: manage users permission to fully trusted administrators until a patched release is available.
Remove the system: manage packages permission from any non-administrator custom roles and review all existing role definitions.
Review recent user records for unexpected role assignments and revert any unauthorized changes.
Inspect the Pagekit packages/ directory for unknown extensions and remove any that cannot be attributed to a legitimate install.

Patch Information

No vendor patch is referenced in the available advisory data. Monitor the VulnCheck Advisory for Pagekit CMS and the upstream Pagekit project for a fixed release addressing the missing authorization check in UserApiController::saveAction().

Workarounds

Place the Pagekit admin interface behind a network access control list or VPN so that only administrators can reach the vulnerable API.
Disable the package installer in production environments and perform package updates only from a controlled staging system.
Implement a reverse proxy rule that blocks requests to /api/user/* when the request body contains role identifiers exceeding the caller's privilege level.

bash

# Example nginx rule to restrict access to the Pagekit admin API
location ~ ^/api/user/ {
    allow 10.0.0.0/8;      # trusted admin network
    deny  all;
    proxy_pass http://pagekit_backend;
}

location ~ ^/admin/system/package/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://pagekit_backend;
}