CVE-2025-64400 — Insufficient permission checks when pre-enrolling users Summary

Description (CNA)

Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that the account requesting a user creation has `edit` on the enrollment-level user directory, but is missing a separate check that the enrollment editor has access (or belongs to) the organization that they are adding a user to.

Affected (CNA)

Vendor / product	Versions
Palantir / com.palantir.controlpanel:control-panel	unaffected 1.1395.1; unaffected 1.1384.1; unaffected 1.1401.0 before ; affected before 1.1401.0; unaffected 1.1346.1; unaffected 1.1352.1; unaffected 1.1352.5

CWE

CWE-284

References

https://palantir.safebase.us/?tcuUid=52a9fd2f-1868-48cb-af01-93c589160e19

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.