CVE-2025-64400 — Insufficient permission checks when pre-enrolling users Summary
Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that the account requesti…
Published: 2025-12-18 · CVSS: 4.1 · CVSS 3.1
Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that the account requesting a user creation has `edit` on the enrollment-level user directory, but is missing a separate check that the enrollment editor has access (or belongs to) the organization that they are adding a user to.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7