CVE-2026-92762 affects Pelican Panel versions prior to 1.0.0-beta35. The vulnerability arises because write permissions during startup are enforced only through disabled form controls on the client side, lacking proper server-side authorization checks. Attackers who possess startup.read permission can exploit this by crafting Livewire state updates that trigger afterStateUpdated callbacks. This enables them to alter startup commands, docker images, and environment variables, leading to arbitrary command execution inside the container.

An attacker with startup.read permission can escalate privileges to execute arbitrary commands within the container by exploiting the missing server-side authorization checks. This could lead to full compromise of the container environment and potentially the host system depending on container isolation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict startup.read permissions to trusted users only and monitor for suspicious Livewire state update activity related to startup configurations.