Pterodactyl Client API Database Allocation Limit Bypass Vulnerability

A logic flaw in the Pterodactyl Client API prior to version 1.12.3 allows users to bypass assigned limits for database allocations. This vulnerability arises from a broken database locking mechanism in the controllers, which fails to properly lock database operations. As a result, multiple simultaneous requests can exploit this flaw to create more databases than permitted, potentially disrupting the web interface.

Impact

This vulnerability allows users to exceed their allocated database limits, which could lead to resource management issues and interfere with the normal functioning of the web interface.

Remediation

Users can upgrade to Pterodactyl version 1.12.3 or later to address this vulnerability.