What’s Vulnerable › Vulnerabilities

CVE-2026-72564: fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-10 · updated 2026-10-24
• Weakness: CWE-639

Description

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource.

Affected products

• fosrl Pangolin: through 1.20.0

References

• https://github.com/fosrl/pangolin
• https://github.com/fosrl/pangolin/blob/main/server/routers/resource/authWithAccessToken.ts

Get alerted when CVE-2026-72564 or the next vulnerability affects your stack