CVE-2026-57518

Description

Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the -user: manage users- permission to escalate privileges by assigning arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the -system: manage packages- permission and then upload and install a malicious PHP package through the admin package installer to achieve remote code execution.