Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

5.5 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P · score source

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Summary An unprotected user enumeration vulnerability exists in the account email update endpoint, allowing authenticated users to verify whether email addresses are registered on the panel through automated requests without rate limiting or CAPTCHA protection. Details The account settings page allows authenticated users to update their email address through a POST request. Unlike the login and password reset forms which implement reCAPTCHA and rate limiting protections, this endpoint lacks these safeguards entirely. An attacker can capture the email update request (for example, using Burp Suite's proxy) and modify the email field to test arbitrary addresses. The panel's response will confirm whether each tested email is already registered in the system. Because there are no rate limits implemented, attackers can send hundreds or thousands of requests to enumerate the user base. This is concerning because: - The login and password reset pages correctly implement protections against…

Published by the source

26 Jun 2026, 20:54 UTC

Last modified by the source

26 Jun 2026, 20:54 UTC

Source last checked

26 Oct 2026, 14:49 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-j7f5-gfqm-pcx3

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-j7f5-gfqm-pcx3

Advisory: Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
IDs: GHSA-j7f5-gfqm-pcx3
Record: https://patchnext.com/advisories/ghsa-j7f5-gfqm-pcx3 (revision 1, source checked 26 Oct 2026, 14:49 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: pterodactyl/panel 1.12.3. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist pterodactyl/panel: affected < 1.12.3; fixed in 1.12.3

## Suggested inspection (read-only)
- Packagist pterodactyl/panel: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on pterodactyl/panel.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-j7f5-gfqm-pcx3 (GitHub-reviewed advisory GHSA-j7f5-gfqm-pcx3 lists affected ranges: Packagist pterodactyl/panel >=0 <1.12.3)

Commands are suggestions: review each one before running it.