CVE-2026-42571
Pelican’s Web User Interface (WebUI) had a privilege‑escalation flaw that let any OAuth‑authenticated user gain administrator rights on certain versions. The issue was fixed in newer releases of the platform.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Pelican platform versions 7.21.0‑7.21.4, 7.22.0‑7.22.2, 7.23.0‑7.23.2, and 7.24.0‑7.24.1. Users who log in via OAuth to the WebUI are potentially affected.
Real-world impact
An attacker who can authenticate to the WebUI could elevate their privileges to admin, allowing them to modify configuration, access all data, and potentially disrupt or exfiltrate sensitive information.
Why this severity
The CVSS score of 9 reflects a high‑impact privilege escalation: the vulnerability is exploitable over the network, requires only low effort, and grants full control over confidentiality, integrity, and availability of the system.
What to do about it
- 01Upgrade Pelican to a patched version: 7.21.5, 7.22.3, 7.23.3, or 7.24.2 or later.
- 02Verify the new version is running by checking the Pelican version page or API.
- 03Restart the Pelican WebUI service to ensure the update takes effect.
NVD-referenced vendor advisory
Timeline
- May 9, 2026 · May 9, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.