CVE-2026-86177

Name of the Vulnerable Software and Affected Versions Pterodactyl Panel versions prior to 1.14.1

Description The software fails to validate action-specific permissions during the creation of scheduled tasks. This allows subusers who possess only the schedule.update permission to execute arbitrary console commands. An attacker can create and immediately trigger scheduled tasks to run game-server console commands, control the server power state, or create backups without the required authorization checks.

Recommendations Update Pterodactyl Panel to version 1.14.1 or later.