The vulnerability in Pterodactyl’s Wings control plane arises from an improperly enforced authorization check on several API endpoints. Any authenticated node, identified only by its secret token, can request information about any server across the entire panel, ignoring the intended node‑server relationship. This omission permits attackers to retrieve installation scripts that may contain sensitive values, alter installation and transfer statuses, and delete servers on remote nodes. Because the affected endpoints expose configuration data and control commands, an attacker can leverage the accessible information to move laterally, exfiltrate secrets, and trigger destructive actions such as permanent data loss. The weakness is classified as unauthorized access (CWE‑283) and secret information disclosure (CWE‑639).

The issue affects the Pterodactyl Panel (Panel 1.12.1 and earlier), specifically the Wings server control plane component. Any node that possesses a secret access token stored in the plaintext file /etc/pterodactyl/config.yml can exploit the flaw. The flaw allows a node to fetch details and manipulate servers that belong to other nodes, thereby violating the principle of least privilege for all servers managed by the panel.

The CVSS score of 9.2 marks this flaw as critical, reflecting the high potential impact on confidentiality, integrity, and availability. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, yet the absence of this vulnerability from the CISA KEV catalog does not diminish the need for remediation. Attackers must first obtain a valid node secret token, which is the prerequisite for leveraging the vulnerable endpoints. Once in possession of such a token, an adversary can perform remote API calls to read or modify any server configuration, exclude proper authorization checks, and potentially orchestrate large‑scale destructive actions across the cluster.