Executive brief
Pterodactyl Panel, a management platform for game servers, contains a flaw in its account settings page. An attacker with a valid account can systematically test email addresses to see if they are registered on the system. This could allow malicious actors to build a database of users for targeted phishing attacks or credential stuffing, compromising user privacy.
Technical details
A user enumeration vulnerability (CWE-204) exists in the Pterodactyl Panel account email update endpoint. While the login and password reset forms implement reCAPTCHA and rate limiting, the email update POST request lacks these protections. An authenticated attacker can submit automated requests to change their email to arbitrary addresses; the server's response differs based on whether the target email is already registered. This allows for large-scale enumeration of the user base. The issue is resolved in version 1.12.3.
Affected products
- Pterodactyl Panel < 1.12.3
Timeline
- 2026-05-23: disclosed
- 2026-06-26: advisory
- 1.12.3: patched
References
- https://api.github.com/users/CybranceeHosting
- https://github.com/CybranceeHosting
- https://api.github.com/users/CybranceeHosting/gists%7B/gist_id%7D
- https://api.github.com/users/CybranceeHosting/repos
- https://avatars.githubusercontent.com/u/120514035?v=4
- https://api.github.com/users/CybranceeHosting/events%7B/privacy%7D