PT-2026-94044

Name of the Vulnerable Software and Affected Versions Pelican Panel versions prior to 1.0.0-beta35 Description Startup write permissions are enforced only through disabled form controls instead of server-side authorization checks. An attacker with startup.read permission can craft Livewire state...

CVE-2026-92762: Missing Authorization

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...