A high-severity privilege escalation vulnerability in FeatherPanel allows authenticated subusers to grant themselves full administrative control over servers, posing a significant risk of unauthorized data access and system compromise.

This is a missing authorization vulnerability (CWE-862) located in the SubuserController updateSubuser handler. The application fails to validate the permissions of an authenticated subuser during a request to update permission records, allowing the user to modify their own access levels.

The ability for a low-privileged subuser to grant themselves full server control constitutes a critical security failure. This unauthorized elevation allows attackers to bypass intended access controls, potentially resulting in the compromise of sensitive server data, loss of backups, and total control over server configurations. Given the CVSS score of 8.8, this flaw represents a significant threat to the confidentiality, integrity, and availability of hosted services.

Immediate Action: Update FeatherPanel to version 1.3.7.10 or later immediately to incorporate the necessary permission validation logic.

Proactive Monitoring: Review server access logs for anomalous permission modification events, specifically looking for subusers who have suddenly acquired administrative-level access strings.

Compensating Controls: While no direct WAF rule can replace a patch, ensure that internal API endpoints are restricted to authorized networks or require multi-factor authentication for administrative actions if possible.

Public Exploit Available: No

The vulnerability in FeatherPanel is severe and requires immediate attention to prevent unauthorized privilege escalation. Administrators should prioritize the deployment of version 1.3.7.10 to remediate the missing authorization flaw. Failure to apply this update leaves the environment vulnerable to internal actors or compromised accounts seeking to gain full control over the server infrastructure.