CVE-2026-92762CWE-862broken-access-control

CVE-2026-92762

High · published September 17, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
50.7
In the wild
Unconfirmed
What it is

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands, docker images, and variables to execute arbitrary commands in the container.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00654 · 50.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-17T01:17Z
References (5)
https://github.com/pelican/panel · [email protected]https://github.com/pelican/panel/blob/fab5da496f7d837574b404e34dc42764a1d6b2c3/app/Filament/Server/Pages/Startup.php#L52-L77 · [email protected]https://github.com/pelican/panel/security/advisories/GHSA-4x28-f89q-2276 · [email protected]https://www.vulncheck.com/advisories/pelican-panel-before-1.0.0-beta35-authorization-bypass-via-startup · [email protected]https://github.com/pelican/panel/security/advisories/GHSA-4x28-f89q-2276 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 20:32Z
    Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup
    cvelistv5