{"id":"EUVD-2026-1041","enisaUuid":"e38df629-1bb2-3c82-a2b2-c3127f9f6843","description":"Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.","datePublished":"Jan 6, 2026, 12:31:14 AM","dateUpdated":"Jan 6, 2026, 7:01:17 PM","baseScore":7.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/pterodactyl/panel/security/advisories/GHSA-8c39-xppg-479c\nhttps://github.com/pterodactyl/panel/commit/2bd9d8baddb0e0606e4a9d5be402f48678ac88d5\nhttps://github.com/pterodactyl/panel/releases/tag/v1.12.0\n","aliases":"CVE-2025-68954\nGHSA-8c39-xppg-479c\n","assigner":"GitHub_M","epss":0.24,"enisaIdProduct":[{"id":"0dd2a0f5-4b23-3209-b085-86a7789d71c3","product":{"name":"panel","vendor":{"name":"ConvoyPanel"}},"product_version":"\u003c  1.12.0"}],"enisaIdVendor":[{"id":"8635d04e-eb19-337a-9cec-43fe240cea4b","vendor":{"name":"pterodactyl"}}],"enisaIdVulnerability":[{"id":"2e5ebe5a-ff1d-3005-b872-808c99de41e2","vulnerability":{"id":"GHSA-8c39-xppg-479c","description":"Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced","datePublished":"Jan 6, 2026, 5:18:56 PM","dateUpdated":"Jan 6, 2026, 5:18:56 PM","baseScore":0.0,"references":"https://github.com/pterodactyl/panel/security/advisories/GHSA-8c39-xppg-479c\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68954\nhttps://github.com/pterodactyl/panel/commit/2bd9d8baddb0e0606e4a9d5be402f48678ac88d5\nhttps://github.com/pterodactyl/panel\nhttps://github.com/pterodactyl/panel/releases/tag/v1.12.0\n","enisa_id":"EUVD-2026-1041\n","aliases":"CVE-2025-68954\nGHSA-8c39-xppg-479c\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:57:39 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"be15667c-2bc8-3226-a200-9e45b7f5c78c","vulnerability":{"id":"CVE-2025-68954","description":"Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.","datePublished":"Jan 6, 2026, 12:31:14 AM","dateUpdated":"Jan 6, 2026, 7:01:17 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/pterodactyl/panel/security/advisories/GHSA-8c39-xppg-479c\nhttps://github.com/pterodactyl/panel/commit/2bd9d8baddb0e0606e4a9d5be402f48678ac88d5\nhttps://github.com/pterodactyl/panel/releases/tag/v1.12.0\n","enisa_id":"EUVD-2026-1041\n","assigner":"GitHub_M","epss":0.24,"dataProcessed":"Nov 4, 2026, 7:12:55 AM","vulnerabilityProduct":[{"id":"8acefc88-47e2-320d-9452-1e5d8e2bcdb3","product":{"name":"panel","vendor":{"name":"ConvoyPanel"}},"product_version":"\u003c  1.12.0"}],"vulnerabilityVendor":[{"id":"97cc99cc-3a27-3991-904c-d461898b19f8","vendor":{"name":"pterodactyl"}}]}}],"enisaIdAdvisory":[]}