The flaw arises from the SubuserController updateSubuser handler failing to validate permission changes. When a subuser submits a crafted request, the system accepts the new permission values without restriction, allowing the attacker to grant themselves full control over the server, including access to sensitive data, backups, and configuration. This is a direct privilege escalation vulnerability. The weakness is identified as access control failure (CWE-862).

The affected product is MythicalLTD FeatherPanel. All versions prior to 1.3.7.10 are impacted. No specific patch versions beyond 1.3.7.10 are listed in the data, so the vulnerability applies to all earlier releases.

With a CVSS score of 8.7 the vulnerability is rated high severity. The EPSS score is not available, providing no insight into current exploitation likelihood, but the lack of a KEV listing does not mitigate the risk given the high potential impact. An authenticated subuser can execute the exploit without additional conditions, making the attack locally feasible on systems where such subusers exist. The attack vector is through normal authenticated API usage, implying that users with subuser accounts are the immediate threat surface.