CVE-2026-84715: FeatherPanel Privilege Escalation Vulnerability

CVE-2026-84715 Overview

CVE-2026-84715 is a privilege escalation vulnerability in FeatherPanel, a game server management panel developed by MythicalLTD. Versions prior to 1.3.7.10 fail to validate permissions in the SubuserController::updateSubuser handler. Authenticated subusers can modify their own permission records by sending a crafted request to the vulnerable endpoint. A subuser with minimal privileges can grant themselves full server control, exposing sensitive data, backups, and server configuration. The weakness is categorized under CWE-862: Missing Authorization.

Critical Impact
A low-privileged authenticated subuser can escalate to full server administrator, gaining unauthorized access to backups, configuration files, and sensitive server data.

Affected Products

FeatherPanel versions prior to 1.3.7.10
MythicalLTD FeatherPanel backend SubuserController component
Deployments exposing the subuser management API to authenticated users

Discovery Timeline

2026-09-02 - CVE-2026-84715 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84715

Vulnerability Analysis

The vulnerability resides in the updateSubuser handler within backend/app/Controllers/User/Server/SubuserController.php. The handler accepts a permissions payload from the authenticated caller and applies it to a subuser record. The code does not verify whether the caller has authority to modify the target subuser's permissions.

Because the check is missing, an authenticated subuser can target their own record and submit an updated permission set. The application writes the attacker-supplied permissions back to storage without checking the caller's role or original permission scope.

Successful exploitation grants full server control, including read access to backups and configuration, and the ability to invoke privileged server actions exposed through ServerGateway.php. The exploit requires only network access and a valid subuser session.

Root Cause

The root cause is missing authorization on a state-changing endpoint. The SubuserController::updateSubuser handler validated request format but did not enforce that the caller possessed a permission-management capability on the target subuser. Combined with a permissive validatePermissions routine that did not restrict entries to a known permission set, the endpoint allowed arbitrary permission grants.

Attack Vector

The attack is remote and authenticated. An attacker with any valid subuser credential on a target server sends a PATCH or PUT request to the subuser update endpoint referencing their own subuser identifier. The request body includes elevated permissions such as full server administration flags. The server persists the change, and subsequent requests execute with the new privileges.

php

// Patch excerpt from backend/app/Chat/Subuser.php
// Source: https://github.com/MythicalLTD/FeatherPanel/commit/06ef8dcac471201748516ca743694159cb846a9d

    /**
-     * Validate permissions format.
+     * Validate permissions format and that each entry is a known subuser permission.
     */
    public static function validatePermissions($permissions): bool
    {

The patch tightens validatePermissions to reject entries outside the known subuser permission set, and the fix ships in APP_VERSIONv1.3.7.10. See the commit 06ef8dc and the v1.3.7.10 release notes.

Detection Methods for CVE-2026-84715

Indicators of Compromise

HTTP requests to the subuser update endpoint where the caller and the target subuser identifier match
Subuser records whose permission arrays contain administrative flags inconsistent with their original role
Audit log entries showing unexpected permission modifications performed by non-administrator accounts
Access to backup download or server configuration endpoints from accounts that were previously limited

Detection Strategies

Review web server and application logs for requests to SubuserController::updateSubuser correlated with the requesting user's own subuser identifier
Compare current subuser permission sets against a known baseline and alert on out-of-band changes
Instrument the panel to log the caller identity and previous versus new permission set on every subuser update

Monitoring Recommendations

Forward FeatherPanel application logs and audit records to a centralized logging or SIEM platform for correlation
Alert on privilege escalation patterns such as a subuser account gaining backup or console permissions within a short window of a subuser update call
Track sudden spikes in backup downloads or console command execution from accounts newly granted those permissions

How to Mitigate CVE-2026-84715

Immediate Actions Required

Upgrade all FeatherPanel installations to version 1.3.7.10 or later
Audit existing subuser permission records and revert any unauthorized grants
Rotate credentials and API tokens for any subuser accounts that exhibited suspicious activity
Review backup downloads and server configuration changes for the exposure window

Patch Information

MythicalLTD released FeatherPanel v1.3.7.10 containing the fix. The patch updates APP_VERSION from v1.3.7.9 to v1.3.7.10 and hardens Subuser::validatePermissions to enforce that each entry is a known subuser permission. Full patch details are available in the security commit and the VulnCheck advisory.

Workarounds

Restrict access to the FeatherPanel administrative interface to trusted networks using firewall or reverse-proxy rules
Disable or minimize the use of subuser accounts until the upgrade is deployed
Remove subusers that are not strictly required and reduce existing subuser permissions to the minimum needed

bash

# Upgrade FeatherPanel to the patched release
cd /path/to/featherpanel
git fetch --tags
git checkout v1.3.7.10
# Apply any required migrations and restart services per project documentation