The vulnerability in Pagekit CMS 1.0.18 arises from insufficient authorization validation in the UserApiController::saveAction() function. Authenticated users who have the 'user: manage users' permission can escalate their privileges by assigning themselves arbitrary custom roles. By assigning a role with the 'system: manage packages' permission, an attacker can upload and install malicious PHP packages through the administrative package installer, resulting in remote code execution on the server.

Successful exploitation allows an authenticated user with limited privileges to escalate their permissions to administrative levels, specifically gaining the ability to manage packages. This leads to the installation of malicious PHP packages, enabling remote code execution on the affected system. This compromises the confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the 'user: manage users' permission to trusted administrators only and monitor for suspicious package installation activities. Avoid granting unnecessary permissions to users and consider disabling the package installer if not required.