CVE-2026-84715

FeatherPanel, an open-source game server management panel, fails to enforce permission checks (CWE-862) in the SubuserController updateSubuser handler in versions before 1.3.7.10. An authenticated subuser can send a crafted request to the updateSubuser endpoint and modify their own permission record, with no validation that they are authorized to change permissions. By doing so, a subuser with even minimal privileges can grant themselves full control of the associated server, gaining unauthorized access to sensitive data, backups, and server configuration. Any FeatherPanel deployment running an affected version that uses the subuser feature is exposed, with only a low-privileged subuser account required as a foothold. There are no known reports of exploitation, no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at about 0.3%.

What to do: Upgrade FeatherPanel to 1.3.7.10 or later, which adds the missing permission validation in the updateSubuser handler. Administrators who cannot upgrade immediately should review subuser permission records for unexpected grants of full control, since a subuser may have already escalated privileges, and audit panel logs for suspicious updateSubuser requests. Restricting panel access to trusted networks and applying least-privilege subuser assignments reduce exposure.