CVE-2026-84715 in FeatherPanel
Summary
by MITRE • 09/02/2026
FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify their own permission records. A subuser with minimal permissions can send a crafted request to grant themselves full server control, enabling unauthorized access to sensitive data, backups, and server configuration.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in FeatherPanel versions prior to 1.3.7.10 represents a critical failure in the application's authorization logic within the SubuserController updateSubuser handler. This flaw is classified under CWE-269 Improper Privilege Control, specifically manifesting as an Insecure Direct Object Reference or Broken Access Control scenario where the server fails to verify whether the authenticated user initiating the request possesses sufficient privileges to modify specific resource attributes. The core technical issue lies in the backend processing of update requests for subuser profiles; rather than strictly enforcing role-based access control policies that restrict permission modifications to administrators only, the system accepts and processes changes submitted by any authenticated session associated with a subuser account. This architectural oversight allows an attacker who has obtained valid credentials for even a low-privilege subuser account to interact directly with the API endpoint responsible for updating user permissions without triggering appropriate authorization checks.
From an operational perspective, this vulnerability enables a severe escalation of privileges that fundamentally compromises the integrity and security posture of the hosting environment. An authenticated subuser can craft specific HTTP requests containing modified permission fields in the payload, effectively granting themselves administrative rights or full server control capabilities previously reserved for superusers. This unauthorized elevation allows the attacker to bypass all intended restrictions imposed by the system administrator. Consequently, the attacker gains unrestricted access to sensitive data stored within the panel's scope, including customer information and financial records if applicable. Furthermore, the ability to modify permission structures often extends to accessing backup mechanisms and server configuration files, which can lead to complete compromise of the underlying infrastructure. The impact is not limited to immediate data theft but also includes long-term persistence through backdoor creation or modification of system settings that facilitate future attacks.
This vulnerability aligns with several entries in the MITRE ATT&CK framework, particularly T1078 Valid Accounts and T1068 Exploitation for Privilege Escalation. The initial access is achieved using valid credentials obtained through phishing, credential stuffing, or other means, while the exploitation phase involves leveraging the flawed permission validation to escalate privileges beyond the intended scope. To mitigate this risk, organizations running FeatherPanel must immediately upgrade to version 1.3.7.10 or later where these authorization checks have been corrected. In environments where immediate patching is not feasible, temporary mitigations include implementing strict network-level access controls on the management interface, ensuring that only trusted IP addresses can reach the panel's administrative endpoints, and enforcing multi-factor authentication to reduce the likelihood of credential compromise. Additionally, security teams should audit existing subuser accounts for any signs of unauthorized permission modifications by reviewing system logs for anomalous update requests originating from low-privilege users. Regular penetration testing focused on access control mechanisms is also recommended to identify similar flaws in other modules before they can be exploited.