Actor

Unauthorized Subuser

1 brief RSS

Pterodactyl Wings Privilege Escalation via Improper JWT Scoping (CVE-2026-54593)

A privilege escalation vulnerability, CVE-2026-54593, exists in Pterodactyl's Wings component that allows authenticated subusers to upload arbitrary files to a server without explicit file creation permissions, due to insufficient validation of panel-signed JSON Web Tokens (JWTs.

Pterodactyl Panel +1 Unauthorized Subuser privilege-escalation vulnerability JWT Pterodactyl web-server

1r 1t 19h ago