A missing server-side authorization check in Pelican Panel allows authenticated attackers to perform unauthorized administrative actions and achieve container-level command execution.

The application incorrectly relies on client-side form controls to restrict access to startup configuration updates. An attacker with minimal startup.read privileges can manipulate Livewire state updates to bypass these UI restrictions, triggering server-side callbacks that permit modification of startup commands and Docker images.

The vulnerability carries a high CVSS score of 8.8, reflecting its potential for full container compromise. By modifying startup commands and environment variables, an attacker can effectively seize control of the application container, leading to unauthorized data access, potential lateral movement within the hosting infrastructure, and significant service disruption.

Immediate Action: Update Pelican Panel to version 1.0.0-beta35 or later immediately to enforce proper server-side authorization for all startup configuration changes.

Proactive Monitoring: Review audit logs for unexpected modifications to server startup commands or Docker image settings, specifically looking for changes initiated by low-privileged user accounts.

Compensating Controls: Implement strict network segmentation and egress filtering for containers to limit the impact of potential command execution, and utilize a Web Application Firewall to block suspicious Livewire state update requests.

Public Exploit Available: No

This vulnerability represents a critical failure in secure development practices where client-side controls were used as a substitute for mandatory server-side authorization. Organizations using Pelican Panel must prioritize the update to version 1.0.0-beta35 to remediate this access control flaw. Failure to patch leaves the environment susceptible to container escape and arbitrary code execution by any authenticated user.