Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

FeatherPanel lets subusers gain full control

CVE-2026-84715 · published 1 month ago
Summary

Versions of FeatherPanel older than 1.3.7.10 let a logged‑in subuser change their own permission settings. By sending a specially crafted request, a subuser with limited rights can give themselves full access to the server, exposing data, backups and configuration. Upgrade to the latest FeatherPanel release to close this gap.

What to do
  • Update mythicalltd featherpanel to version 1.3.7.10 or later.
Affected software
VendorProductAffected versions
mythicalltd featherpanel < 1.3.7.10
Original advisory text
FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update
FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify their own permission records. A subuser with minimal permissions can send a crafted request to grant themselves full server control, enabling unauthorized access to sensitive data, backups, and server configuration.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published2 Sep 2026
Updated30 Oct 2026
First seen2 Sep 2026
Sources
CVE-2026-84715 · NVD
CVE-2026-84715 · MITRE
CVE-2026-84715 · OSV
Track software like this
Free during beta