CVE-2025-68954 HIGH

CVE-2025-68954: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced

Vendor Pterodactyl

Product panel

Weakness CWE-613 · Insufficient session expiration

Published January 6, 2026

Last update January 6, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.

Key dates

02Disclosure timeline

January 6, 2026 CVE published

January 6, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-68954 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/613.html