CVE-2026-72564
CriticalCVSS 9.6Summary
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource. The server/routers/resource/authWithAccessToken.ts handler calls verifyResourceAccessToken() without passing the target resourceId, so a valid token scoped to resource X in organization A passes verification for resource Y in organization B.
Risk Assessment
An attacker can gain unauthorized access to resources across organizations, potentially leading to data confidentiality and integrity breaches.
Recommendation
Update fosrl/pangolin to the latest patched version. Additionally, review access logs for unusual authentication attempts.
Original NVD description (English source)
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource. The server/routers/resource/authWithAccessToken.ts handler calls verifyResourceAccessToken() without passing the target resourceId, so a valid token scoped to resource X in organization A passes verification for resource Y in organization B.