---
id: CVE-2026-92762
title: >-
  Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions
  only through disabled form controls rather than server-side authorization
  checks
summary: >-
  Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions
  only through disabled form controls rather than server-side authorization
  checks. Attackers with startup.read permission can craft Livewire state
  updates to inv…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-862
vendor: pelican
product: panel
affected:
  - panel < 1.0.0-beta35
published: '2026-09-16'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:08:55.030'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92762'
references:
  - url: 'https://github.com/pelican/panel'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pelican/panel/blob/fab5da496f7d837574b404e34dc42764a1d6b2c3/app/Filament/Server/Pages/Startup.php#L52-L77
    label: disclosure@vulncheck.com
  - url: 'https://github.com/pelican/panel/security/advisories/GHSA-4x28-f89q-2276'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/pelican-panel-before-1.0.0-beta35-authorization-bypass-via-startup
    label: disclosure@vulncheck.com
  - url: 'https://github.com/pelican/panel/security/advisories/GHSA-4x28-f89q-2276'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00654
epssPercentile: 0.4916
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-18T18:28:46.575087Z'
ingestedAt: '2026-09-16T21:05:36.895Z'
---

## Overview

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands, docker images, and variables to execute arbitrary commands in the container.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.