| 제목 | Pangolin (https://pangolin.net/) Pangolin Project (https://github.com/fosrl/pangolin) <=1.15.4 Improper Access Controls |
|---|
| 설명 | Pangolin (https://github.com/fosrl/pangolin) is an open-source, identity-based remote access platform built on WireGuard that enables secure, seamless connectivity to private and public resources.
The Pangolin version of <= 1.15.4 is vulnerable to a cross-organization privilege escalation. This vulnerability allows an attacker with addUserRole permissions to escalate privileges by assigning arbitrary roles to any user, including themselves, across any organization.
This vulnerability fundamentally collapses Pangolin’s multi-tenant security architecture, enabling attackers to seize unauthorized administrative control across all organizations and leading to massive cross-tenant data breaches and total system compromise.
- Fix Commit:
https://github.com/fosrl/pangolin/commit/5e37c4e85fae68e756be5019a28ca903b161fdd5 |
|---|
| 원천 | ⚠️ https://gist.github.com/henrrrychau/0457bef6776d0c99688f9cf55cdf55f7 |
|---|
| 사용자 | h3nrrrych4u (UID 95805) |
|---|
| 제출 | 2026. 02. 24. AM 04:49 (8 개월 ago) |
|---|
| 모더레이션 | 2026. 03. 08. AM 08:06 (12 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 347796 [fosrl Pangolin 까지 1.15.4-s.3 Role verifyRoleAccess/verifyApiKeyRoleAccess 권한 상승] |
|---|
| 포인트들 | 0 |
|---|