Pelican Panel - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/pelican-panel/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 16 Sep 2026 21:55:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthorization Bypass in Pelican Panel via Livewire State Manipulationhttps://feed.craftedsignal.io/briefs/2026-09-pelican-panel-auth-bypass/Wed, 16 Sep 2026 21:55:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-pelican-panel-auth-bypass/Pelican Panel versions before 1.0.0-beta35 fail to enforce server-side write permissions, allowing attackers with read-only access to achieve arbitrary command execution via manipulated Livewire state updates.Pelican Panel versions prior to 1.0.0-beta35 contain an authorization bypass vulnerability (CVE-2026-92762) affecting startup configuration management. The application erroneously relies on client-side form controls to restrict write access to startup settings. An attacker possessing only 'startup.read' permissions can exploit this by crafting malicious Livewire state updates. These updates trigger 'afterStateUpdated' callbacks, which bypass intended authorization checks. By invoking these callbacks, the attacker can modify critical server settings, including startup commands, Docker images, and environment variables. This manipulation allows for the injection of malicious payloads that result in arbitrary command execution within the application container. The vulnerability highlights the danger of relying on UI-level restrictions for security-sensitive administrative operations.

Impact

Successful exploitation of this vulnerability allows an attacker with limited read-only permissions to gain full control over the container environment managed by Pelican Panel. This enables arbitrary code execution, potential data exfiltration from the container, and lateral movement within the host infrastructure if container isolation is insufficient.

Recommendation

Prioritized actions for security and infrastructure teams:

  • Upgrade all Pelican Panel instances to version 1.0.0-beta35 or later immediately to patch CVE-2026-92762.
  • Audit user permission sets within Pelican Panel to ensure that the 'startup.read' permission is limited to the minimum number of users required.
  • Review and harden Docker container security profiles (e.g., using AppArmor or Seccomp) to limit the impact of potential arbitrary command execution within the container runtime.
  • Implement monitoring on administrative API endpoints related to startup configurations and Livewire state management to detect abnormal update patterns.
]]>highadvisoryweb-vulnerabilityauthorization-bypasscve-2026-92762