A missing authorization check in the Pterodactyl Wings control plane allows an attacker with a compromised node token to access and manipulate sensitive data from other nodes in the infrastructure.

This vulnerability involves an authorization bypass (CWE-639) where the system fails to verify that the requesting node is authorized to access specific server data. Any authenticated Wings node possessing a valid secret access token can retrieve sensitive configuration data, including installation scripts, and manipulate the status of servers belonging to different nodes.

The ability to access server installation scripts and manipulate server status poses a significant risk to the integrity and confidentiality of game server environments. Because these scripts often contain sensitive values or secrets, a compromise of a single node token can lead to lateral movement across the entire Pterodactyl instance. With a CVSS score of 8.1, this represents a high-severity risk that could facilitate unauthorized administrative control over hosted game instances.

Immediate Action: Upgrade Pterodactyl Wings to version 1.12.1 or later to implement the necessary authorization checks.

Proactive Monitoring: Review access logs for unusual requests originating from Wings nodes, specifically targeting endpoints that retrieve server configuration or installation metadata.

Compensating Controls: Ensure that node secret tokens are stored securely and rotate them if there is any suspicion of unauthorized access or exposure in configuration files like /etc/pterodactyl/config.yml.

Public Exploit Available: Unknown

Given the potential for unauthorized data exfiltration and control over server instances, administrators should prioritize patching their Pterodactyl infrastructure immediately. Failure to update allows any node with a compromised token to effectively bypass security boundaries, creating a systemic risk to all servers managed by the panel.