CVE-2026-92762 — Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup
Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with sta…
Published: 2026-09-16 · CVSS: 8.7 · CVSS 4.0
Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands, docker images, and variables to execute arbitrary commands in the container.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7