Pterodactyl Panel missing scheduled-task authorization enables subuser privilege escalation

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.

• Pterodactyl Panel: the CNA identifies semver >= 0, < 1.14.1 as affected.
• Pterodactyl Panel 1.14.1: listed as unaffected.
• The status of parallel branches or releases outside these boundaries is not separately established by the available evidence.

Pterodactyl Panel contains a Missing Authorization flaw in scheduled task creation and execution. In the affected implementation, StoreTaskRequest checks only schedule.update, while the caller controls an action such as command, power, or backup and its associated payload. An authenticated subuser who can manage schedules can therefore create a task without the corresponding action permission, such as control.console, a power-control permission, or backup.create. When the task runs, RunTaskJob sends console and power operations to the daemon, or invokes the backup service, without rechecking the actor's permissions. The patch adds an action-to-permission mapping, checks the required permission when a task is created or updated, and checks scheduled tasks before execution. The reachable surface is the Panel Client API; the available evidence does not establish whether the flaw provides access to the Panel host or systems outside the game-server scope.

• The issue is reachable over the network through authenticated requests to the Pterodactyl Panel Client API.
• An attacker needs an authenticated subuser account with access to the server and at least schedule.update; no separate user's interaction is required.
• The record characterizes the path as low complexity: create a scheduled task for an action that the subuser was not granted, then trigger the schedule.
• Public exploit documentation has been published in a researcher advisory, but the record does not confirm exploitation of any particular deployment.

• The flaw enables privilege escalation between subusers sharing a server, defeating action permissions intentionally withheld by the server owner.
• Confirmed technical outcomes include arbitrary game-server console command execution, power-state control, and unauthorized backup creation.
• Console commands may affect data and configuration within the game-server scope; access to particular data depends on the game server's privileges and the accepted payload.
• The available evidence does not establish impact to the operating-system host, other servers, or Panel itself, so host-level code execution should not be assumed.

• Authorization bypass: a subuser whom the server owner limited to schedule management can perform operations that require separate permissions.
• Integrity impact: arbitrary game-server console commands may change server-managed state or data.
• Availability impact: power actions such as stopping, restarting, or killing a server may interrupt service.
• Operational and data impact: unauthorized backup creation may consume resources or produce data copies outside approved procedures.
• The available evidence focuses on servers managed by Panel and does not establish control of the Panel host or other servers.

1. Upgrade Pterodactyl Panel to exactly version 1.14.1, then verify the deployed version across every administrative instance and node.
2. Before upgrading, temporarily remove schedule.update from subusers who do not need schedule management, or restrict their access to affected servers. This is an operational risk reduction measure, not a confirmed vendor workaround.
3. Review and disable or remove suspicious scheduled tasks with command, power, or backup actions, and examine tasks executed while an affected version was deployed.
4. After updating, verify that action-specific authorization is enforced for task creation, task updates, and schedule execution. A test account with only schedule.update should not be able to perform other actions without their corresponding permission.
5. If unauthorized tasks or activity are found, preserve Panel, daemon, and game-server logs for investigation before changing or deleting related data.

1. Inventory all Pterodactyl Panel deployments and compare their running versions with the affected range in affected_summary.
2. Identify subusers who have schedule.update but lack relevant permissions such as control.console, control.start, control.stop, control.restart, or backup.create.
3. Review scheduled tasks with action values of command, power, or backup, especially tasks created, changed, or triggered by subusers.
4. Examine available Panel activity and audit records for schedule execution events, including server:schedule.execute where that event is logged.
5. Correlate daemon or game-server logs for unexpected console commands, power-state changes, or backup activity. This is precautionary monitoring, not a confirmed indicator of compromise.
6. The absence of suspicious log entries does not prove safety; combine log review with version, permission, and task-history checks.