---
id: CVE-2026-86177
title: >-
  Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions
  in scheduled task creation, allowing subusers with only schedule.update
  permission to execute arbitrary console commands
summary: >-
  Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions
  in scheduled task creation, allowing subusers with only schedule.update
  permission to execute arbitrary console commands. Attackers can create and
  immediately …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-862
vendor: pterodactyl
product: panel
affected:
  - panel < 1.14.1
published: '2026-09-05'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86177'
references:
  - url: 'https://github.com/geo-chen/oss/blob/main/panel.md'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/pterodactyl/panel'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pterodactyl/panel/blob/v1.14.0/app/Http/Requests/Api/Client/Servers/Schedules/StoreTaskRequest.php#L10-L25
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pterodactyl/panel/blob/v1.14.0/app/Jobs/Schedule/RunTaskJob.php#L60-L75
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pterodactyl/panel/commit/913b354aff43ff04fce95357ed68a675a1dd0fa6
    label: disclosure@vulncheck.com
  - url: 'https://github.com/pterodactyl/panel/releases/tag/v1.14.1'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/pterodactyl-panel-before-1.14.1-privilege-escalation-via-schedule-tasks
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00577
epssPercentile: 0.45233
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-08T18:13:59.381722Z'
ingestedAt: '2026-09-06T07:51:56.636Z'
---

## Overview

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.