# CVE-2026-92762: Pelican Panel privilege escalation via client-side authorization

Source: https://junglewise.ai/threats/cve-2026-92762-pelican-panel-privilege-escalation-via-client-side-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92762 · Severity: high · CVSS 8.8 · Published 2026-09-16

Pelican Panel is a game server management tool that allows administrators to configure and control containerized game servers. The vulnerability allows authenticated users with limited startup read permissions to bypass authorization controls and modify server configurations, including startup commands and Docker images, leading to arbitrary command execution inside containers. This could compromise game server availability and allow attackers to execute malicious code with container-level privileges.

## Quick answers

**Is CVE-2026-92762 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92762 being exploited in the wild.

**How severe is CVE-2026-92762?** High severity, with a CVSS score of 8.8, published 16 September 2026.

**Which products and versions are affected?** Pelican Panel before 1.0.0-beta35.

**Is there a fix for CVE-2026-92762?** A patch was published on 2026-09-16: Fix available in version 1.0.0-beta35 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92762 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92762?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Pelican Panel enforces startup write permissions exclusively through disabled HTML form controls on the client side rather than implementing server-side authorization checks. An attacker with startup.read permission can bypass this client-side restriction by crafting malicious Livewire state updates to invoke afterStateUpdated callbacks, enabling modification of startup commands, Docker images, and environment variables. The vulnerability requires the attacker to already have authenticated access with startup.read permission and can result in arbitrary command execution within the container. The fix is available in version 1.0.0-beta35 and later.

## Affected products

- Pelican Panel before 1.0.0-beta35

## Timeline

- 2026-09-16: disclosed
- 2026-09-16: patched: Fix available in version 1.0.0-beta35 and later

## References

- [https://github.com/pelican/panel](https://github.com/pelican/panel)
- [https://github.com/pelican/panel/blob/fab5da496f7d837574b404e34dc42764a1d6b2c3/app/Filament/Server/Pages/Startup.php](https://github.com/pelican/panel/blob/fab5da496f7d837574b404e34dc42764a1d6b2c3/app/Filament/Server/Pages/Startup.php)