CVE-2026-92762

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls in the web UI, with no corresponding server-side authorization checks (CWE-862). A user holding only the startup.read permission — typically a delegated subuser on a game server — can craft Livewire state updates that invoke afterStateUpdated callbacks, causing the panel to accept changes it should have rejected. By modifying the startup command, Docker image, and container variables this way, the attacker achieves arbitrary command execution inside that server's container. Any operator running an affected Pelican Panel version who has granted limited accounts startup read access is exposed, a common pattern among game-server hosting providers and communities. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Upgrade Pelican Panel to 1.0.0-beta35 or later, which adds server-side enforcement of startup write permissions. Until upgraded, audit all subuser accounts and remove or restrict startup read grants for any user who should not be able to run code in the container, and treat existing startup.read holders as potential code-execution risk. Review container logs for unexpected changes to startup commands, Docker images, or variables, and limit panel network exposure where possible.