CVE-2026-35202
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Vulnerability in Pterodactyl prior to version 1.12.3. A logic flaw in the Client API allows users to bypass database allocation limits due to a broken locking mechanism.
Risk Assessment
The risk is the possibility of unauthorized creation of additional databases, which could lead to server overload or resource isolation breach.
Recommendation
It is recommended to update Pterodactyl to version 1.12.3 or later.
Original NVD description (English source)
Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue.