CVE-2026-72564 in Pangolin
Summary
by MITRE • 08/10/2026
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource. The server/routers/resource/authWithAccessToken.ts handler calls verifyResourceAccessToken() without passing the target resourceId, so a valid token scoped to resource X in organization A passes verification for resource Y in organization B.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical authorization flaw in the fosrl/pangolin application affecting versions up to v1.20.0, where an authenticated remote attacker can bypass legitimate access controls through token reuse manipulation. The core technical issue stems from improper implementation of access token validation within the server/routers/resource/authWithAccessToken.ts handler component. When verifyResourceAccessToken() function is invoked, it fails to receive or validate the target resourceId parameter that should establish the intended scope of authorization. This omission creates a fundamental gap in the authentication flow where tokens issued for specific resources and organizations can be indiscriminately applied to different resources within other organizational contexts.
The operational impact of this vulnerability extends beyond simple privilege escalation, creating an environment where attackers can gain unauthorized access to any resource across all organizations within the system. This represents a severe breakdown in the principle of least privilege and separation of concerns that should inherently protect distinct organizational boundaries and resource isolation. The flaw allows for cross-organizational resource access, potentially enabling data exfiltration, system manipulation, or complete compromise of resources belonging to other entities within the same application ecosystem. Attackers could exploit this by simply obtaining a valid access token from one organization's resource and using it against another organization's resource, effectively circumventing the intended authorization mechanisms.
This vulnerability aligns with CWE-285, which addresses improper authorization issues in software systems, specifically targeting the failure to properly verify access control permissions. From an attack perspective, this flaw maps directly to ATT&CK technique T1078.004 for valid accounts and T1566.001 for credential access through token manipulation. The implementation error demonstrates poor input validation and parameter handling within the authentication flow, where critical scope verification is omitted during token validation. Organizations using this software face significant risk of unauthorized data access and potential system compromise across their entire user base.
Mitigation strategies should focus on implementing proper token scope validation by ensuring that verifyResourceAccessToken() function receives and validates the target resourceId parameter before granting access. The authentication flow must enforce strict resource-specific authorization checks, where tokens are validated against both their issued scope and the intended target resource. Organizations should immediately implement token binding mechanisms that associate tokens with specific resources and organizations, preventing cross-usage scenarios. Additionally, comprehensive logging of authentication attempts and access patterns should be enabled to detect potential exploitation attempts, while regular security audits should validate proper implementation of authorization controls throughout all application components.