What’s Vulnerable › Vulnerabilities
CVE-2025-64400: Insufficient permission checks when pre-enrolling users Summary
- Severity: medium (CVSS 4.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-18 · updated 2026-06-17
- Weakness: CWE-284
Description
Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that the account requesting a user creation has `edit` on the enrollment-level user directory, but is missing a separate check that the enrollment editor has access (or belongs to) the organization that they are adding a user to.
Affected products
- Palantir com.palantir.controlpanel:control-panel: before 1.1401.0 — fixed in 1.1401.0
How to fix
Upgrade to a fixed version: Palantir com.palantir.controlpanel:control-panel 1.1401.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-64400 or the next vulnerability affects your stack