CVE-2026-92762: Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup
Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands, docker images, and variables to execute arbitrary commands in the container.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pelican Panelto a version that resolves this vulnerability.Fixed in 1.0.0-beta35 - Compensating control
Because Pelican Panel versions before 1.0.0-beta35 can be bypassed via startup state updates, restrict/limit access to any UI functionality that grants 'startup.read' and startup-write capabilities until the upgrade to 1.0.0-beta35 is applied.
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker needs an authenticated Pelican Panel account with startup.read permission. No additional privileges or user interaction are required.
Are default restrictions sufficient to prevent exploitation?
No. The affected versions rely on disabled form controls to restrict startup changes, but the server does not enforce the corresponding authorization checks. A user with only startup.read permission can submit crafted Livewire state updates.
What changes can an attacker make?
The attacker can modify startup commands, Docker images, and variables. These changes can be used to execute arbitrary commands in the affected container.
Which versions are affected?
Pelican Panel versions before 1.0.0-beta35 are affected.