Authorization Bypass in FeatherPanel SubuserController

FeatherPanel versions prior to 1.3.7.10 contain a critical authorization vulnerability within the SubuserController updateSubuser handler. This vulnerability arises due to a failure to validate permissions during the update process for subuser accounts. An authenticated attacker possessing a low-privileged subuser account can submit a crafted request to the application to modify their own permission records. By manipulating these records, a subuser can grant themselves elevated administrative privileges, including full server control. This escalation allows the attacker to gain unauthorized access to sensitive server data, configuration files, and backups, effectively compromising the integrity and confidentiality of the hosting environment managed by the panel. This vulnerability is classified as an authorization bypass, allowing privilege escalation.

Impact

Successful exploitation of this vulnerability allows low-privileged subusers to gain full administrative control over the FeatherPanel installation. This results in unauthorized access to sensitive server-side data, system configurations, and automated backups. Depending on the server deployment, this could lead to total system compromise, exfiltration of customer data, or disruption of hosted services.

Recommendation

• Upgrade all FeatherPanel instances to version 1.3.7.10 or later immediately.
• Audit logs for suspicious activity originating from existing subuser accounts, specifically monitoring for frequent or unauthorized modification requests to the SubuserController endpoint.
• Review all current subuser privilege levels to identify unauthorized account upgrades that may have occurred prior to patching.