Threat Intelligence Database

CVE-2025-64400 is a medium-severity vulnerability in Palantir's Control Panel product that allows unauthorized actors to pre-register users into organizations without proper access checks. The flaw arises because the API only verifies that the requester has edit permissions on the enrollment-level user directory but fails to confirm that the requester belongs to or has access to the specific organization they are adding users to. This can lead to unauthorized user creation across organizational boundaries, potentially exposing sensitive enrollment data. Exploitation requires network access and privileges to edit the enrollment-level directory but does not require user interaction. While the impact on confidentiality is limited and there is no integrity or availability impact, the vulnerability could facilitate unauthorized access or lateral movement within affected environments. No known exploits are currently in the wild. European organizations using Palantir Control Panel should review and restrict enrollment-level edit permissions and monitor user creation activities. Countries with significant Palantir deployments, such as the UK, Germany, France, and the Netherlands, are most likely to be affected.

MediumVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-64400