CVE Catalog
CVE-2026-72564
CriticalCVSS 9.6Summary
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource.
Risk Assessment
The risk includes unauthorized access to resources of other organizations, potentially leading to breach of isolation and data leakage.
Recommendation
Update pangolin to a patched version and implement token binding mechanisms to specific resources.
Original NVD description (English source)
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource.