CVE-2026-92762

Published: Sep 16, 2026Modified: Sep 24, 2026Deferred

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands, docker images, and variables to execute arbitrary commands in the container.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (5)

https://github.com/pelican/panel

Source: disclosure@vulncheck.com

https://github.com/pelican/panel/blob/fab5da496f7d837574b404e34dc42764a1d6b2c3/app/Filament/Server/Pages/Startup.php#L52-L77

Source: disclosure@vulncheck.com

https://github.com/pelican/panel/security/advisories/GHSA-4x28-f89q-2276

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/pelican-panel-before-1.0.0-beta35-authorization-bypass-via-startup

Source: disclosure@vulncheck.com

https://github.com/pelican/panel/security/advisories/GHSA-4x28-f89q-2276

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.