Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks.
CVSS 4.0HIGH 8.7·Network·Low privileges·No interaction·EPSS 0.00654·Published 2026-09-16·Fixed in 1.0.0-beta35CWE-862