CVE-2026-92762
highPelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks.
Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands, docker images, and variables to execute arbitrary commands in the container.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/pelican/panel disclosure@vulncheck.com
- https://github.com/pelican/panel/blob/fab5da496f7d837574b404e34dc42764a1d6b2c3/app/Filamen... disclosure@vulncheck.com
- https://github.com/pelican/panel/security/advisories/GHSA-4x28-f89q-2276 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/pelican-panel-before-1.0.0-beta35-authorization-bypas... disclosure@vulncheck.com
- https://github.com/pelican/panel/security/advisories/GHSA-4x28-f89q-2276 134c704f-9b21-4f2e-91b3-4a467353bcc0