Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users possessing the 'user: manage users' permission to create arbitrary custom roles with elevated privileges. The missing authorization check in UserApiController::saveAction() lets an attacker self-assign a custom role that grants 'system: manage packages', enabling upload and installation of malicious PHP packages via the admin package installer, resulting in remote code execution. This flaw illustrates a classic Missing Authorization weakness (CWE-862) and could compromise the confidentiality, integrity, and availability of the affected site.

The vulnerability affects Pagekit CMS version 1.0.18 and, by extension, any systems running that exact release. The product is provided by the vendor Pagekit. No finer version granularity is available in the CVE record, so any deployment of Pagekit CMS 1.0.18 should be considered at risk unless a patch has been applied.

The CVSS score of 8.7 signals a high‑severity flaw, and while an EPSS score is not available, the lack of mitigation information and the ability for an attacker to elevate privileges at will indicate that exploitation is likely if the vulnerable package is in use. The issue is not currently listed in the CISA KEV catalog, but the described attack path—self‑assigning a privileged role and installing code—provides a low‑effort vector that can achieve remote code execution if the attacker can authenticate to the site. Administrators should treat this as a high‑risk vulnerability that requires prompt remediation.