Portainer Community Edition had a missing authorization check for its Docker plugin endpoints (/plugins/*), allowing users who are not administrators but have endpoint access through RBAC to perform privileged plugin operations such as installing and enabling plugins directly against the Docker daemon. This flaw enables an attacker to execute arbitrary code on the host system, compromising confidentiality, integrity, and availability of the underlying infrastructure. The vulnerability is rooted in a lack of authorization control, identified by CWE‑862.

Portainer Community Edition versions from 2.33.0 up to but not including 2.33.8, the 2.39.2 build, and the 2.41.0 release are affected. Any installation of these releases that exposes non‑admin roles to Docker endpoints via Portainer’s RBAC configuration is at risk.

The CVSS score of 9.4 signals critical severity, and although an EPSS score is not supplied, the absence of a KEV listing does not reduce the risk, as attacker effort remains low for users with endpoint access. The likely attack vector is remote interaction with the Portainer service over its web interface or API, exploiting the unauthenticated ability of standard users to invoke privileged plugin actions on the local Docker daemon.