What’s Vulnerable › Vulnerabilities

CVE-2026-92762: Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-16 · updated 2026-09-24
• Weakness: CWE-862

Description

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands, docker images, and variables to execute arbitrary commands in the container.

Affected products

• pelican panel: before 1.0.0-beta35 — fixed in 1.0.0-beta35

How to fix

Upgrade to a fixed version: pelican panel 1.0.0-beta35. Check the vendor advisory for mitigations.

References

• https://github.com/pelican/panel
• https://github.com/pelican/panel/blob/fab5da496f7d837574b404e34dc42764a1d6b2c3/app/Filament/Server/Pages/Startup.php#L52-L77
• https://github.com/pelican/panel/security/advisories/GHSA-4x28-f89q-2276
• https://www.vulncheck.com/advisories/pelican-panel-before-1.0.0-beta35-authorization-bypass-via-startup
• https://github.com/pelican/panel/security/advisories/GHSA-4x28-f89q-2276

Get alerted when CVE-2026-92762 or the next vulnerability affects your stack