Portainer Community Edition has incorrect default permissions (CWE-276) that grant regular users privileges enabling host filesystem access and host-level code execution. An authenticated non-admin user with endpoint access can exploit these insecure defaults to read host files or escalate privileges to root on the host system. The vulnerability is publicly disclosed with a high CVSS 4.0 score of 8.5, indicating significant impact potential. No patch or official remediation level has been documented yet, and the product is not a cloud service, so remediation depends on vendor updates or configuration changes.

An authenticated non-administrative user with endpoint access can exploit the insecure default permissions to access the host filesystem and execute code with root-equivalent privileges on the host. This compromises the confidentiality, integrity, and availability of the host system managed by Portainer CE. The vulnerability poses a high risk of privilege escalation and unauthorized data access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict endpoint access to trusted users only and review Portainer CE configurations to minimize privilege exposure. Monitor vendor channels for updates or patches addressing this vulnerability.