CVE-2026-35202

Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue.

CVSS

No CVSS.

References

Link	Resource
https://github.com/pterodactyl/panel/security/advisories/GHSA-fgmm-w5cx-vrfw

Configurations

No configuration.

History

22 Jul 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Pterodactyl es un panel de gestión de servidor de juegos gratuito y de código abierto. Antes de la versión 1.12.3, la API de cliente de Pterodactyl tiene un fallo lógico que permite a los usuarios eludir sus límites asignados para asignaciones de base de datos. Esto ocurre porque el mecanismo de bloqueo de la base de datos utilizado en los controladores está totalmente roto y en realidad no bloquea nada. La versión 1.12.3 corrige el problema.

02 Jun 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-02 20:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-35202

Mitre link : CVE-2026-35202

CVE.ORG link : CVE-2026-35202

JSON object : View

Products Affected

No product.

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-35202", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35202", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-03T12:47:43.889583Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pterodactyl", "product": "panel", "versions": [{"status": "affected", "version": "< 1.12.3"}]}]}], "published": "2026-06-02T20:16:35.143", "references": [{"url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-fgmm-w5cx-vrfw", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-367"}, {"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue."}, {"lang": "es", "value": "Pterodactyl es un panel de gesti\u00f3n de servidor de juegos gratuito y de c\u00f3digo abierto. Antes de la versi\u00f3n 1.12.3, la API de cliente de Pterodactyl tiene un fallo l\u00f3gico que permite a los usuarios eludir sus l\u00edmites asignados para asignaciones de base de datos. Esto ocurre porque el mecanismo de bloqueo de la base de datos utilizado en los controladores est\u00e1 totalmente roto y en realidad no bloquea nada. La versi\u00f3n 1.12.3 corrige el problema."}], "lastModified": "2026-07-22T19:10:00.120", "sourceIdentifier": "security-advisories@github.com"}