CVE-2026-84715: Mythicalltd Featherpanel

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify their own permission records. A subuser with minimal permissions can send a crafted request to grant themselves full server control, enabling unauthorized access to sensitive data, backups, and server configuration.

Affected products

• Mythicalltd Featherpanel: before 1.3.7.10 (fixed in 1.3.7.10)

Published 2026-09-02. Last modified 2026-09-10.