We want to be upfront: 1.2.0 took us nearly ten months to reach a stable release, and that hurt. We over-promised, under-delivered, and then spent months stabilizing what we should have gotten right the first time. 1.3.0 went the other way. Development started right after 1.2.0 shipped in April, and the beta is here roughly six months later - and it is still a larger update in every measurable sense.

More than 300 commits. Over 50 pull requests. Two-factor authentication, a rebuilt payments flow, reversible server cancellations, a redesigned settings page, database snapshots, and a long list of fixes for bugs you told us about. This is also the first release standing on the new modular extension system we promised when we moved to MPL 2.0 - the groundwork for the addon ecosystem we keep talking about.

But this is a beta, so let's be clear about what that means.

Getting the Beta​

The beta documentation is live and versioned. Before you use it, make sure the version selector in the top-right of the docs is set to 1.3.0 (Public Beta).

• Updating from 1.2.x? Follow the beta update guide. It covers the maintenance window, pulling the development branch, updating dependencies, running migrations, and the new permissions:sync step. Updating to the beta is only supported from the latest stable release, so make sure you are on 1.2.x first.
• Installing fresh? Follow the installation guide for Debian and Ubuntu.
• Not sure what to test? The beta testing checklist lists the features and fixes most worth your attention.
• Want the full details? Read the changelog.

What's Changed​

New Features & Improvements​

• Two-factor authentication. TOTP with QR setup and recovery codes, built as a module so additional methods can be added without touching core files.
• Reversible server cancellations. Canceled servers now show a Resume button instead of Cancel.
• Reworked payments. Admins get manual controls on every payment - confirm, recheck, cancel, reopen, and a one-way refund. Credits are granted only on the transition to paid, so a payment can never be granted twice.
• Per-gateway handling fees. None, percentage, or fixed, with an optional minimum and maximum - shown at checkout, in the order total, in the admin payments table, and on invoices.
• Smarter checkout. Gateways that do not support your currency or fall below their minimum are disabled with the reason. Totals recalculate live, and coupons now apply before tax.
• More currencies, matching what the payment gateways actually accept.
• Redesigned settings page. Grouped and described sections, conditional fields, unit labels, a fixed mobile layout, and masked secrets.
• Clearer server status badges and a sort control on the server creation page.
• Ticket priority and category can now be changed by staff, and the admin ticket list sorts by priority.
• Better admin UX. Delete confirmations on every delete button, single-target mass notifications, and a settings page that enforces its own permission.
• Optional protection. A minimum Discord account age for linking, and a verified email before referral rewards - both off by default.
• Privacy Policy / Terms checkbox on registration, shown when configured.
• Database snapshots with one command - create and restore without mysqldump or any external tool.
• Log rotation. Daily compression with retention, so single log files no longer grow out of control.
• Redis is now the default store for cache, sessions, queues, and settings (still configurable).

Bug Fixes​

• Fixed installations failing on MySQL/MariaDB due to incompatible migrations.
• Fixed customised default roles being overwritten by updates and reseeds.
• Fixed a successful Stripe payment being marked as failed when tax was enabled.
• Fixed invoices not being generated - they now generate reliably and are emailed to the customer as a PDF.
• Fixed incorrect checkout totals when coupons and partner discounts were involved.
• Fixed payment emails and payment lists showing a hard-coded "Credits" instead of your configured name.
• Fixed upgrades and downgrades ignoring per-product server limits, charging before success, and double-charging on retries.
• Fixed the allocation limit being treated as per-location instead of per-node, which blocked server creation on healthy nodes.
• Fixed servers with no Pterodactyl ID breaking the server list and settings page - they can now be managed and deleted cleanly.
• Fixed server sync deleting servers on any error instead of only on a confirmed removal.
• Fixed server creation failing when a required egg variable defaulted to 0.
• Fixed the credit run-out estimate on the home page getting stuck at a fixed ceiling.
• Fixed the Pterodactyl installer dropping a custom port from the panel URL.
• Fixed a broken extension or seeder being able to take down the whole panel on startup.
• Added friendly error pages across server, payment, and registration flows, and stopped leaking Pterodactyl details to users and API clients.

Security​

• Sanitised rich content submitted through TinyMCE forms - legal pages, MOTD, notifications, and more - against script injection. This one is non-critical, since only privileged users could submit such content.
• Sanitised Pterodactyl and provider errors so internal addresses, credentials, and response bodies never reach users or API clients.
• The settings page and admin endpoints now enforce their permissions, and secrets are masked in the UI.

For Developers​

• Reworked extension system. Extensions can now ship their own database seeders, sidebar pages, middleware, routes, migrations, and Artisan or scheduled commands, all following standard Laravel conventions.
• New permissions:sync and permissions:cleanup commands keep permissions and roles in step across updates.
• OpenAPI specification generation with Scribe - php artisan scribe:generate.
• Laravel 12 under the hood.
• The user API can now filter by linked Discord account.

A Note on AI​

We want to be upfront about something, the same way we were about the license change and about 1.1.

AI tools are part of our development process now, and you deserve to know how we use them - and how we do not.

To be clear: AI is a tool, not a replacement for developers. Every line that lands in CtrlPanel is reviewed, tested, and owned by a human maintainer. We do not merge code simply because a model produced it, and we never will.

What AI does is take the busywork off our plate. A task that takes a model two minutes - a repetitive test, a boilerplate migration, a scaffolded file - can eat twenty minutes of a maintainer's time. Delegating that routine work is what lets us spend the hours where they actually matter: architecture, security, reviewing contributions, and supporting users.

Our quality standards have not moved, and we are not lowering them to ship faster. If anything, they are going up, and the extra time AI frees up goes straight back into review and testing. The extended beta you are reading about is exactly that standard in practice.

We know "AI" is a divisive topic. We are not here to sell it to you, and we are not hiding it either. We will keep telling you when and how it is used, and everything we ship will keep being held to the same bar it always has been.

Help Us Test​

This is an open beta, and it only works if you help. The features most worth your attention are the ones with the most moving parts - payments, server upgrades, and two-factor authentication - but everything is fair game.

If you find something broken, report it in the #🧪┃beta-feedback channel on our Discord server, or open a GitHub issue.

For any major security risk, please create a GitHub vulnerability report and DM 1day2die on Discord. Do not discuss vulnerabilities in public chats, and do not post them on public trackers.

Acknowledgements​

A beta like this is built by more than the core team, and we owe a real thank you to the people who helped get it here.

• Simba and KroZen for their contributions to the codebase and the server and billing work in this release.
• Lezetho for the Discord account age requirement.
• Every beta tester who installs this build, breaks it, and tells us how - that is the work that turns a beta into a stable release. ❤️
• And everyone who filed issues, joined discussions, or just kept running CtrlPanel while we worked.

Thank you. You are what keeps this project alive.

This beta also includes a number of internal refactors, performance improvements, and smaller fixes not listed above.

Full changelog: https://ctrlpanel.gg/docs/beta/changelog
Compare on GitHub: https://github.com/Ctrlpanel-gg/panel/compare/1.2.0...development
Beta testing checklist: https://ctrlpanel.gg/docs/beta/beta-testing

Why We're Making This Change​

When we adopted AGPL 3.0 back in the 1.0 release, we did not fully think through its implications. In practice, AGPL 3.0 turned out to be far more restrictive than we intended - addon and theme developers couldn't legally sell their work, and users couldn't customize the panel for their own needs without publishing their changes. That was never the goal, and it was quietly killing the community we were trying to build.

MPL 2.0 fixes this. It keeps the project open and protected, while giving everyone the freedom they actually need.

As part of this transition, we are also introducing a Contributor License Agreement (CLA) for all future pull requests. Contributors will be asked to sign it when opening a PR. This is part of a broader effort to give CtrlPanel a proper legal foundation - something we should have had from the start.

For Users​

If you just run CtrlPanel to sell game servers to your customers, not much changes for you.

• You can download, install, and run the panel freely
• You can modify any files - change the UI, add features, integrate with your own systems
• You can use the panel commercially
• Your customers accessing the panel through a browser is not considered distribution - you have no obligations in that case
• If you ever give or sell a copy of your modified panel to another person or company, you must provide the modified files - but since CtrlPanel is written in PHP, there is nothing extra to prepare. The source code is already what you are distributing.

In short - run it, customize it, build a business on it. You're good.

For Addon & Theme Developers​

This is where the biggest change is, and where MPL 2.0 makes things much more practical.

If your addon does not modify our core files​

This is the cleanest scenario. If your addon is a separate package or file that does not touch CtrlPanel's existing source files:

• You can license it however you want, including proprietary
• You can sell it on market.ctrlpanel.gg or anywhere else, fully closed source
• You have no MPL obligations whatsoever

This is why we are actively thinking about a more modular extension system - so that addons never need to touch core files in the first place. More on that in the future.

If your addon modifies our core files​

If your work involves editing CtrlPanel's existing source files, MPL 2.0 still allows you to sell it - but with one important condition: the modified core files must remain under MPL 2.0, and you must provide them to anyone you distribute to - which, again, is nothing extra since PHP is already source code.

This does not mean a public release. You are only required to provide source code to the people you directly sell or distribute to - not to the general public. You are not required to publish anything on GitHub or anywhere publicly accessible.

However, keep in mind that once a recipient has that source code, they are legally allowed to share it further. MPL does not restrict what recipients can do with source code they legitimately received. If keeping your modifications private long-term is important to you, the safest approach is to avoid modifying core files and build your addon as a separate package instead.

Modular Extension System​

The safest way to keep your addon code fully closed is to never touch core files at all - and we want to make that possible for every type of addon.

Currently, CtrlPanel has a modular system for payment gateways, and we are ready to expand it further. If you need an internal API or hook that does not exist yet, there are two ways to help make it happen:

• Open an issue on GitHub describing what you need - we will consider it for an upcoming release
• Open a PR that adds the implementation yourself - the fastest path to getting it in

Either way, make sure to follow our contribution guidelines before getting started - see the relevant files in the .github directory of the repository.

The more developers build addons the right way, the stronger and more sustainable the ecosystem becomes for everyone.

A note for theme developers​

We ask that you preserve the original CtrlPanel copyright notice in the panel footer. You are welcome to add your own copyright alongside it - just don't remove ours. This is both a license requirement and a matter of respect for the project and its contributors.

For Those Looking to Fork​

MPL 2.0 allows anyone to take CtrlPanel's code, modify it, and redistribute it - including commercially. If you do, here is what the license requires:

• Modified MPL-licensed files must remain under MPL 2.0
• You must keep existing copyright notices intact
• You cannot relicense the MPL-covered files as proprietary

Building on open source is fine. Stripping it of its open source nature is not.

Summary​

*As long as you don't distribute the code to others.
**Modified core files must remain MPL 2.0 and source must be provided to recipients.

If you have questions about what this means for your specific use case, feel free to join our Discord, we are happy to help. And if you want the full legal text, you can read the Mozilla Public License 2.0 directly.

We want to be transparent with our community: version 1.1 was released prematurely, and we are not proud of that. It shipped with too many rough edges and took far longer to stabilize than it should have. We heard your frustration, and we took it seriously.

With 1.2.0, we made a commitment to not repeat that mistake. This release went through a full beta testing phase before reaching stable, and we are confident it reflects the quality our users deserve.

This update brings a large number of bug fixes, new features, and importantly, patches for several critical security vulnerabilities. We strongly urge every CtrlPanel user to upgrade as soon as possible. Do not wait for themes or addons to be updated first - running an outdated version puts both you and your clients at risk.

License Change​

Starting with this release, CtrlPanel moves from AGPL 3.0 to the Mozilla Public License 2.0 (MPL 2.0).

We'll be honest - we didn't fully think through the implications of AGPL 3.0 when we adopted it. As we looked closer, we realized it was placing an unreasonable burden on our community - particularly on users running the panel and developers building third-party addons. The license was doing more harm than good, and that was never our intention.

MPL 2.0 is a more balanced license that still protects the project while giving the community the freedom it needs to grow.

As for previous versions - we are not officially relicensing them, but we have no intention of taking any action against AGPL 3.0 non-compliance in older releases. That said, compliance with MPL 2.0 is required for this version and all future releases - no exceptions.

A dedicated blog post covering all the details including what this means for addon and theme developers will be published tomorrow, April 25th.

Acknowledgements​

This release would not have been possible without the help of our contributors and beta testers.

A special thank you to Simba and FerksFK for their contributions to the codebase, and to Maddigan for his invaluable work during beta testing - single-handedly tracking down the vast majority of bugs in this release.

We also want to thank everyone who responsibly disclosed security vulnerabilities that are patched in this release. Your names will be added to the Hall of Fame in our SECURITY.md once the CVE details are publicly disclosed.

Thank you to everyone else who contributed, reported issues, or helped test along the way. You are what keeps this project alive ❤️.

What's Changed​

Bug Fixes​

• Fixed credits being displayed as 1000x their actual value in parts of the UI and API responses
• Fixed the OOM Killer checkbox not saving its value
• Fixed HTTP 500 on the admin overview page when the .git directory is missing
• Fixed "Log back in" being unavailable to admins after using "Login as User"
• Fixed potential referral system abuse through account deletion - deleted referrals are now visible to admins
• Fixed php artisan route:cache failing due to duplicate route names
• Fixed mass user notifications failing if one email address was rejected by the mail server
• Fixed server creation flow allowing credits to be deducted even when server creation failed
• Fixed allocation limit applying globally instead of per-node, which blocked server creation on all nodes when only one reached its limit
• Fixed multiple coupons created via range function having their value saved as 1000x less than intended
• Fixed manual email confirmation not triggering events, which prevented users from receiving their referral and email confirmation rewards
• Fixed coupon application unlocking the payment button without a selected payment gateway
• Fixed 100% off coupons not allowing users to claim a product for free without selecting a payment gateway
• Fixed admins being unable to delete coupons
• Fixed referral commission calculation returning incorrect amounts
• Fixed regular users being able to view coupon and voucher-related logs
• Fixed payment confirmation email formatting
• Fixed broken installation caused by a database column type mismatch

New Features & Improvements​

• Added support for coupons with unlimited uses
• Added "Minimum product price" setting for coupons
• Added option to automatically delete expired vouchers and those that have reached their usage limit
• Added ability for users to change or remove an applied coupon at checkout
• Coupons are now temporarily reserved during checkout and only marked as used after a successful payment
• Added ticket deletion confirmation prompt
• Added a notification 3 days before server suspension when the user has insufficient credits
• Added rate limiting for server creation to prevent abuse from repeated rapid requests
• Added optional reason field for server and user moderation actions via the API
• Added Ukrainian localization; extended Russian localization
• Added ability to change thousand and decimal separators - either globally or per user based on their locale
• Admins can now select all eggs in a nest by clicking the nest name in the product configuration list
• Products now accept 0 as a value for unlimited resources
• Products in the upgrade/downgrade list are now sorted by price
• Removed the global minimum-credits setting - each product now defines its own minimum-credits value
• Removed "Generate random codes" from the coupon edit page
• Reordered settings items for better readability
• Fully reworked payment gateways - admins must now configure webhook tokens per gateway
• Redesigned the version info card on the overview page
• Installer step can now be reset by adding ?reset to the URL, without needing DevTools or clearing site data
• User creation command (php artisan make:user) now returns an error if the email or Pterodactyl ID is already in use

Fixed Vulnerabilities​

• CVE-2026-34234 (CVSS Score 10.0/10) - Unauthenticated RCE via Installer Accessible After Installation and Unsanitized Shell Arguments
• CVE-2026-34358 (CVSS Score 8.1/10) - Missing Authorization on Admin Write Endpoints Allows RBAC Bypass
• CVE-2026-34246 (CVSS Score 4.8/10) - Stored XSS in Admin Role Management via Unescaped DataTable HTML Output
• CVE-2026-34216 (CVSS Score 6.6/10) - Unsafe Dynamic Class Instantiation in Admin Settings Allows Potential Remote Code Execution
• CVE-2026-34241 (CVSS Score 8.7/10) - Stored XSS in Ticket Reply Notifications Allows Session Hijacking
• CVE-2026-34233 (CVSS Score 6.5/10) - Missing Authorization on Admin Datatable Endpoints Allows Unauthorized Access to Sensitive Data

This release also includes a number of internal bug fixes, performance improvements, and code refactors not listed above.
Full Changelog: https://github.com/Ctrlpanel-gg/panel/compare/1.1.1...1.2.0