CVE-2026-84715: FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update
FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify their own permission records. A subuser with minimal permissions can send a crafted request to grant themselves full server control, enabling unauthorized access to sensitive data, backups, and server configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FeatherPanelto a version that resolves this vulnerability.Fixed in 1.3.7.10
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated FeatherPanel subuser can exploit it, including one that starts with only minimal permissions. No user interaction is required.
Are default deployments affected?
The available data identifies all FeatherPanel versions before 1.3.7.10 as affected and does not describe any configuration prerequisite or mitigation through default settings.
What access can an attacker obtain after exploitation?
A malicious subuser can modify their own permission record to grant full server control. This can provide unauthorized access to sensitive data, backups, and server configuration.
What version resolves the issue?
FeatherPanel 1.3.7.10 is identified as the fixed release. Deployments running versions before 1.3.7.10 should be upgraded.