{"id":"CVE-2026-86177","title":"Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands","summary":"Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately …","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-862"],"vendor":"pterodactyl","product":"panel","affected":["panel < 1.14.1"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:20:09.950","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86177","references":[{"url":"https://github.com/geo-chen/oss/blob/main/panel.md","label":"disclosure@vulncheck.com"},{"url":"https://github.com/pterodactyl/panel","label":"disclosure@vulncheck.com"},{"url":"https://github.com/pterodactyl/panel/blob/v1.14.0/app/Http/Requests/Api/Client/Servers/Schedules/StoreTaskRequest.php#L10-L25","label":"disclosure@vulncheck.com"},{"url":"https://github.com/pterodactyl/panel/blob/v1.14.0/app/Jobs/Schedule/RunTaskJob.php#L60-L75","label":"disclosure@vulncheck.com"},{"url":"https://github.com/pterodactyl/panel/commit/913b354aff43ff04fce95357ed68a675a1dd0fa6","label":"disclosure@vulncheck.com"},{"url":"https://github.com/pterodactyl/panel/releases/tag/v1.14.1","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/pterodactyl-panel-before-1.14.1-privilege-escalation-via-schedule-tasks","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-08T18:13:59.381722Z"},"epss":0.00309,"epssPercentile":0.23922,"ingestedAt":"2026-09-06T07:51:56.636Z","slug":"CVE-2026-86177","body":"## Overview\n\nPterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":8316,"id":"CVE-2026-86177","ts":1788919997337,"field":"exploit_available","old":"false","new":"true"},{"seq":8125,"id":"CVE-2026-86177","ts":1788919287114,"field":"exploit_available","old":"true","new":"false"},{"seq":7934,"id":"CVE-2026-86177","ts":1788916358696,"field":"exploit_available","old":"false","new":"true"},{"seq":7743,"id":"CVE-2026-86177","ts":1788915304630,"field":"exploit_available","old":"true","new":"false"},{"seq":7552,"id":"CVE-2026-86177","ts":1788912719066,"field":"exploit_available","old":"false","new":"true"},{"seq":7361,"id":"CVE-2026-86177","ts":1788911337144,"field":"exploit_available","old":"true","new":"false"},{"seq":7165,"id":"CVE-2026-86177","ts":1788909080621,"field":"exploit_available","old":"false","new":"true"},{"seq":6977,"id":"CVE-2026-86177","ts":1788907394007,"field":"exploit_available","old":"true","new":"false"},{"seq":6779,"id":"CVE-2026-86177","ts":1788905446421,"field":"exploit_available","old":"false","new":"true"},{"seq":6597,"id":"CVE-2026-86177","ts":1788903460621,"field":"exploit_available","old":"true","new":"false"},{"seq":6383,"id":"CVE-2026-86177","ts":1788901812419,"field":"exploit_available","old":"false","new":"true"},{"seq":6213,"id":"CVE-2026-86177","ts":1788899562889,"field":"exploit_available","old":"true","new":"false"},{"seq":5976,"id":"CVE-2026-86177","ts":1788898181310,"field":"exploit_available","old":"false","new":"true"},{"seq":5865,"id":"CVE-2026-86177","ts":1788895711917,"field":"exploit_available","old":"true","new":"false"},{"seq":5775,"id":"CVE-2026-86177","ts":1788894573097,"field":"exploit_available","old":"false","new":"true"}]}