CVE-2026-72564

Summary

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource.

Affected Software

Weaknesses

• CWE-639: CWE-639: Authorization Bypass Through User-Controlled Key

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://github.com/fosrl/pangolin
• https://github.com/fosrl/pangolin/blob/main/server/routers/resource/authWithAccessToken.ts

• ←Previous
• Next→