A race condition in the Client API allows an authenticated user to bypass assigned database allocation limits by exploiting a broken locking mechanism. The flaw, identified as CWE‑367 and causing potential resource exhaustion (CWE‑770), lets a user create more database resources than intended, which could lead to service degradation or denial of service if the limit is exceeded over time.

Pterodactyl Panel versions earlier than 1.12.3 are affected. Users running any older release are vulnerable until they upgrade to version 1.12.3 or later; no further version details are supplied.

The CVSS score of 2.3 indicates low severity, and there is no EPSS data or listing in CISA KEV, suggesting limited public exploitation. An attacker would need to be an authenticated API user, implying the risk is confined to internal users who could abuse the API. The lack of a robust locking mechanism means the flaw can be reproduced without special conditions, but the impact remains limited to resource over‑allocation rather than full system compromise.