CVE-2026-54593

🗓️ 28 Jul 2026 15:42:56Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 69 Views🌐 WEB

JWT scope flaw let subusers upload without file.create; fixed in Panel 1.12.3 and Wings 1.12.2.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-54593	28 Jul 202615:42	–	attackerkb
Circl	CVE-2026-54593	28 Jul 202616:35	–	circl
Cvelist	CVE-2026-54593 Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions	28 Jul 202615:42	–	cvelist
EUVD	EUVD-2026-49880	28 Jul 202615:42	–	euvd
Github Security Blog	Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions	28 Jul 202615:43	–	github
NVD	CVE-2026-54593	28 Jul 202616:19	–	nvd
OSV	GHSA-8R6W-3QQ5-4P4R Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions	28 Jul 202615:43	–	osv
OSV	GO-2026-6120 Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings	18 Aug 202614:32	–	osv
Positive Technologies	PT-2026-65514	28 Jul 202600:00	–	ptsecurity
Snyk	Improper Restriction of Security Token Assignment	28 Jul 202617:49	–	snyk

Vulners

Node

pterodactyl panelRange<1.12.3

[
  {
    "vendor": "pterodactyl",
    "product": "panel",
    "versions": [
      {
        "version": "< 1.12.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/pterodactyl/wings/commit/d0ddc80844479302abdaf9654de3bacd511c0f5c
github	www.github.com/pterodactyl/panel/commit/7ffcd636310bb72b54bac3280d2a15e727feded7
github	www.github.com/pterodactyl/panel/pull/5636
github	www.github.com/pterodactyl/panel/security/advisories/GHSA-8r6w-3qq5-4p4r

Parameter	Position	Path	Description	CWE
Authorization	header	/upload/file	JWT misuse: panel-signed tokens with server_uuid/user_uuid/unique_id claims could be replayed against /upload/file to write arbitrary files without proper permission.	CWE-1270, CWE-1259

30 Jul 2026 19:29Current

6Medium risk

Vulners AI Score6

CVSS 3.18.1

EPSS0.00357

SSVC