Pangolin CVE-2026-72001

The attacker must possess at least one valid share link for any resource on the target Pangolin instance - the specific resource or organization the share link belongs to is irrelevant. The attacker must also know or discover the resource identifier (e.g., URL or resource slug) of the target resource they wish to access on the same instance. Exploitation is network-accessible with no authentication beyond the single share link, no user interaction, and no special client software. The vulnerability is not gated on any non-default configuration - all Pangolin deployments using the share-link authentication feature prior to 1.22.0 are affected. Exploitation is limited to instances where the attacker can acquire even one share link; deployments that have never issued share links are not exposed. Cross-organizational access requires that multiple organizations share the same Pangolin instance.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) reflects a network-exploitable flaw requiring no complexity or user interaction, with the only prerequisite being possession of one valid share link (PR:L). Real-world risk is elevated by the cross-organizational blast radius: a share link from a low-sensitivity public resource in one organization can be weaponized to access high-sensitivity resources in entirely separate organizations on the same Pangolin instance. This makes the 'low privilege' prerequisite effectively trivial in shared or community deployments. No KEV listing exists and no public exploit code has been identified, which tempers urgency slightly - but the attack mechanism is straightforward enough that the absence of public exploit code should not be treated as a reliable protection. The primary limiting factor is access to any valid share link; in deployments where share links are distributed broadly or publicly, this prerequisite may be trivially satisfied. There is no confidentiality/integrity ambiguity in the CVSS signals - all sources agree on high C and I impact.

An attacker enrolled in a low-sensitivity Pangolin resource (e.g., a public documentation site shared via share link) crafts an authentication request to the share-link endpoint, substituting the URL parameter to reference a high-sensitivity resource belonging to a different organization on the same Pangolin instance. Because the token verification call omits the resource identifier, Pangolin validates the attacker's share-link token as legitimate and grants full authenticated access to the target resource, bypassing all configured authentication controls. No public exploit code has been identified, but the mechanism requires only HTTP request manipulation and knowledge of another resource's identifier.