CVE-2026-72001 in Pangolin
Summary
by MITRE • 08/31/2026
Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token verification call. Attackers holding a single valid share link for any resource can authenticate against arbitrary resources across different organizations, bypassing all configured authentication methods including SSO, resource passwords, PIN codes, email allowlists, and header authentication.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified in Pangolin versions prior to 1.22.0 represents a critical authentication bypass flaw rooted in improper validation of access tokens during the share-link verification process. This security defect allows unauthenticated attackers to circumvent all configured authentication mechanisms by manipulating URL parameters within the share-link authentication endpoint. The core technical issue lies in how the application processes requests for resource sharing, specifically failing to ensure that the identifier embedded or expected in the token matches the actual target resource being accessed. By supplying an attacker-controlled URL parameter that omits the expected resource identifier from the token verification call, an adversary can trick the system into validating a share link against resources it was not originally intended for. This logic error effectively decouples the authentication credential from its specific scope, allowing a single valid share link to be reused across arbitrary resources within different organizations hosted on the same instance of Pangolin.
The operational impact of this vulnerability is severe due to the breadth of access control methods that are rendered ineffective by this flaw. Organizations relying on robust security postures typically employ multiple layers of authentication and authorization, including Single Sign-On (SSO), resource-specific passwords, PIN codes, email allowlists, and header-based authentication schemes. Under normal circumstances, these controls would prevent unauthorized users from accessing sensitive data or administrative functions. However, the exploitation of this vulnerability allows an attacker to bypass all such protections simultaneously. An individual possessing a legitimate share link for any public-facing document can leverage this flaw to access protected resources belonging to other tenants or departments within the same deployment. This capability effectively nullifies multi-tenant isolation and exposes confidential information to unauthorized parties without requiring additional credentials or privilege escalation techniques beyond the initial possession of one valid share token.
From a classification perspective, this vulnerability aligns with CWE-287, which denotes Improper Authentication, as well as CWE-345, Insufficient Verification of Data Authenticity. The failure occurs during the verification phase where the system does not adequately validate that the context of the authentication request matches the intended resource scope defined by the token's original issuance parameters. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior is consistent with techniques involving credential access and privilege escalation through abuse of trust relationships or misconfigured identity management systems. The attack vector relies on parameter manipulation within HTTP requests, which falls under input validation failures that are common in web application architectures where dynamic routing parameters are not strictly bound to their expected data types or scopes during backend processing logic.
To mitigate this vulnerability, organizations running Pangolin versions earlier than 1.22.0 must upgrade immediately to the patched version released by the vendor. This update addresses the underlying code defect that permits the omission of resource identifiers in token verification calls. Until an upgrade is feasible, administrators should consider implementing strict input validation at a reverse proxy or Web Application Firewall level to detect and block requests where share-link parameters deviate from expected formats or omit required identifier fields. Additionally, reviewing access logs for unusual patterns of cross-resource authentication attempts can help identify potential exploitation in real-time. It is also advisable to audit the configuration of shared links to ensure that they are issued with appropriate expiration times and limited scopes, thereby reducing the window of opportunity and the blast radius should a similar vulnerability be discovered in future versions.