CyberRota Analysis
AI-GeneratedFeatherPanel versions prior to 1.3.7.10 are vulnerable due to inadequate permission validation in the SubuserController updateSubuser handler, allowing authenticated subusers to escalate their privileges. This flaw enables a subuser with limited permissions to craft a request that grants them full control over the server, potentially exposing sensitive data and configurations. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access and data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify their own permission records. A subuser with minimal permissions can send a crafted request to grant themselves full server control, enabling unauthorized access to sensitive data, backups, and server configuration.