Is there a patch available for CVE-2026-35202?

Yes, a patch is available for CVE-2026-35202. Update the affected software to the latest version immediately.

Pterodactyl Panel CVE-2026-35202

Q: What is the CVSS score of CVE-2026-35202?

CVE-2026-35202 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34010 LOW

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-05-26 https://github.com/pterodactyl/panel

GHSA-fgmm-w5cx-vrfw

PHP Authentication Bypass

2.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 13:21 vuln.today

Analysis Generated

Jun 08, 2026 - 13:21 vuln.today

CVSS changed

Jun 02, 2026 - 20:22 NVD

2.3 (LOW)

DescriptionGitHub Advisory

Summary

The Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything.

Details

Inside DatabaseController.php, the code tries to prevent multiple databases from being created at once by calling $server->databases()->lockForUpdate(). In Laravel, this just configures a query builder but never actually sends a command to the database because it’s missing a terminal method like count() or get(). It’s basically a no-op that does nothing.

Since there’s no real lock, multiple requests hitting the endpoint at the exact same time will all see that the database count is under the limit. They all move forward to the DeployServerDatabaseService and successfully create extra resources on the physical host.

Impact

Users are able to create more databases than they are supposed to, potentially also breaking the web interface.

AnalysisAI

Resource quota bypass in Pterodactyl Panel prior to 1.12.3 allows authenticated users to exceed their assigned database allocation limits by exploiting a broken concurrency guard in the Client API. The lockForUpdate() call in DatabaseController.php is a non-terminating Laravel query builder call that never issues an actual SQL lock, making it a no-op that enables parallel requests to simultaneously pass the limit check. No public exploit has been identified at time of analysis; with EPSS at 0.04% (12th percentile) and no KEV listing, real-world exploitation risk is currently low but relevant to multi-tenant hosting deployments.

Technical ContextAI

Pterodactyl Panel is a PHP-based game server management panel built on the Laravel framework, identified by CPE pkg:composer/pterodactyl_panel. The flaw resides in DatabaseController.php, where $server->databases()->lockForUpdate() is called to serialize concurrent database creation requests. In Laravel's Eloquent ORM, lockForUpdate() is a chainable, non-terminal query builder method that appends a FOR UPDATE clause to an SQL query - but without a subsequent terminal call such as count() or get(), the query is never executed and no database-level row lock is ever acquired. The result is a textbook CWE-367 (TOCTOU: Time-of-Check Time-of-Use) race condition: all concurrent requests read the current database count as under-limit before any single write is committed, causing all of them to advance to DeployServerDatabaseService and successfully provision excess databases on the physical host.

RemediationAI

Upgrade Pterodactyl Panel to version 1.12.3 or later, which contains the vendor-released patch addressing the broken lock in DatabaseController.php. The fix is documented in the GitHub Security Advisory at https://github.com/pterodactyl/panel/security/advisories/GHSA-fgmm-w5cx-vrfw. If an immediate upgrade is not feasible, a compensating control is to apply request rate limiting or concurrency throttling at the reverse proxy or API gateway layer specifically for the database creation endpoint - this narrows the TOCTOU window and significantly reduces the likelihood of a successful race but does not fully eliminate the vulnerability. Note that rate limiting may also affect legitimate rapid provisioning workflows. No other specific workarounds are identified in the available advisory data.