CVE-2026-34358

Vulnerability

CtrlPanel versions 1.1.1 and prior contain a broken access control vulnerability where multiple admin controllers enforce permission checks on form display methods (create(), edit()) but omit equivalent checks on the corresponding write methods (store(), update()). Affected controllers include ApplicationApiController (requires admin.api.write), CouponController (admin.coupons.write), PartnerController (admin.partners.write), ShopProductController (admin.store.write), UsefulLinkController (admin.useful_links.write), and VoucherController (admin.voucher.write) for both store() and update(); ProductController (admin.products.edit), ServerController (write/change_owner/change_identifier), and UserController (write/change_email/change_credits/change_username/change_password/change_role/change_referral/change_ptero/change_serverlimit) for update() only. Additionally, ActivityLogController exposed empty stub store()/update() methods that silently accepted any request [2].

Exploitation

An authenticated attacker without admin write privileges can bypass RBAC by sending direct POST or PATCH requests to the affected endpoints, skipping the form UI entirely. No user interaction is required beyond having a valid session. For example, a direct POST to /admin/coupons with crafted parameters creates a coupon without the admin.coupons.write permission [2]. The attacker can also abuse UserController.logBackIn() without the login_as permission to interfere with admin impersonation sessions [2].

Impact

Successful exploitation allows an attacker to perform actions reserved for administrators: issue API credentials, generate unlimited coupons and vouchers, assign arbitrary partner commission and discount rates, alter shop product pricing and limits, reassign server ownership or identifiers, and modify user accounts including roles, credits, passwords, and linked Pterodactyl IDs. This leads to full privilege escalation. Additionally, the logBackIn() flaw can disrupt admin session restoration [2].

Mitigation

The vulnerability is fixed in CtrlPanel version 1.2.0 [1]. No workarounds are documented; all users should upgrade to this release. The issue is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of publication.