Low severityGHSA Advisory· Published Jun 2, 2026· Updated Jun 4, 2026

CVE-2026-35202

Description

Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
pterodactyl/panelPackagist	< 1.12.3	1.12.3

Affected products

Pterodactyl/PanelGHSA
Range: < 1.12.3

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-fgmm-w5cx-vrfwghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-35202ghsaADVISORY
github.com/pterodactyl/panel/security/advisories/GHSA-fgmm-w5cx-vrfwnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.065
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000