An authenticated privilege escalation vulnerability in Pterodactyl Panel allows subusers to execute unauthorized administrative actions, including arbitrary remote code execution within game containers.

The application suffers from a missing authorization flaw (CWE-862) where the StoreTaskRequest logic only verifies the schedule.update permission. Consequently, any authenticated subuser with scheduling access can bypass intended restrictions to perform actions such as command, power, or backup without possessing the necessary administrative permissions.

Successful exploitation allows a low privileged subuser to escalate their access to full control over a game server instance. This results in unauthorized remote code execution (RCE) within the container, potential theft of sensitive environment variables (such as database credentials), and the ability to disrupt service availability by stopping or destroying the server. Given the CVSS score of 8.8, this vulnerability represents a high risk to the confidentiality, integrity, and availability of hosted game environments.

Immediate Action: Update Pterodactyl Panel to version 1.14.1 or later immediately to incorporate the required permission validation checks.

Proactive Monitoring: Review API access logs for anomalous POST requests to the /api/client/servers/{server}/schedules/{id}/tasks endpoint, specifically looking for tasks utilizing the command action from non-administrative accounts.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and block suspicious API payloads targeting task creation, particularly those containing shell commands or unexpected power control strings.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the researcher write-up referenced in the CVE data.

This vulnerability presents a significant risk to multi-tenant environments where subusers are granted limited permissions. Because a public proof-of-concept is available, threat actors may easily weaponize this flaw to gain unauthorized control over affected servers. Administrators must prioritize upgrading to version 1.14.1 to enforce necessary authorization checks and prevent privilege escalation.