Description

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-05T11:16:46.397Z",
  "pubdate": "2026-09-05T11:16:46.397Z",
  "executiveSummary": "Pterodactyl Panel versions prior to 1.14.1 contain an authorization bypass vulnerability within the scheduled task creation process. The flaw stems from insufficient validation of action-specific permissions during the instantiation of scheduled tasks.\nBy leveraging a subuser account possessing only the 'schedule.update' permission, an authenticated attacker can circumvent access control lists to define and execute arbitrary tasks that should otherwise be restricted.\nThe impact includes unauthorized execution of administrative game-server console commands, manipulation of server power states, and unauthorized triggering of backup operations. This represents a critical escalation of privilege for a subuser, effectively allowing them to bypass intended operational boundaries.\nExploitation requires an authenticated session with minimal 'schedule.update' privileges. This vulnerability exposes the underlying infrastructure to unauthorized administrative control, potentially leading to server disruption, data exfiltration via unauthorized backups, or full command injection on the game server process. The lack of granular permission enforcement at the action-dispatch layer confirms a significant weakness in the panel's authorization architecture.",
  "technicalDetails": "The vulnerability resides in the Pterodactyl Panel’s backend permission validation logic, which manages scheduled tasks. When a user with the 'schedule.update' permission initiates the creation or modification of a scheduled task, the application fails to perform a secondary, granular validation check against the specific actions assigned to that task.\nIn a secure implementation, the authorization layer should verify that the user possesses the necessary permissions for the individual actions defined within a schedule (e.g., sending console commands, modifying power states). In the affected versions, the system incorrectly assumes that the existence of the 'schedule.update' privilege grants an implicit authorization to define any task behavior.\nThe attack flow begins with an authenticated subuser account that has been granted the 'schedule.update' permission. The attacker interacts with the panel's API or web interface to craft a new scheduled task payload. Within the task definition, the attacker specifies malicious actions, such as sending arbitrary commands to the game server console, issuing power signals (start, stop, kill), or initiating unintended server backups.\nUpon submission, the Pterodactyl Panel validates the user’s 'schedule.update' capability but fails to inspect the underlying payload for forbidden actions. Consequently, the task is saved to the database. The attacker then triggers the task execution, either by waiting for the scheduled interval or by manually forcing an immediate execution if available. The application's task runner executes these commands with the elevated context of the server owner, ignoring the subuser's limited scope.\nThe vulnerable component is the task scheduling engine responsible for action dispatching. Because the authorization check is performed only at the entry point of task configuration rather than at the point of action execution, the security boundary is effectively negated. Post-exploitation, the attacker achieves persistent unauthorized control over the server instance. This allows for long-term command injection, the ability to crash services, or the creation of backup snapshots that an unauthorized user could potentially exfiltrate, depending on the panel's configuration and storage backend access."
}