What is the CVSS score of EUVD-2026-55242?

EUVD-2026-55242 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Pangolin are affected by EUVD-2026-55242?

fosrl Pangolin versions through v1.20.0 contain a critical cross-tenant authorization bypass in which authenticated users can reuse access tokens across any resource in any organization, collapsing…. A patch is available.

How to fix or mitigate EUVD-2026-55242?

Within 24 hours, identify all deployments of fosrl Pangolin v1.20.0 or earlier and conduct an urgent audit of access token usage patterns and cross-tenant API requests to detect exploitation signs. Within 7 days, implement interim compensating controls listed below, segment network access by tenant, and perform comprehensive historical log review for unauthorized cross-tenant requests with notification to affected customers. Within 30 days, apply a vendor-released patch for fosrl Pangolin when available; if no patch is released by day 30, implement additional API gateway-level tenant-context verification and evaluate alternative products.

Pangolin EUVD-2026-55242

| CVE-2026-72564 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-10 TuranSec

GHSA-cwr5-3cmp-8877

Authentication Bypass Pangolin

9.6

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.6 CRITICAL

Network-reachable with a low-privileged token (PR:L), trivial replay (AC:L), and cross-tenant reach breaks the security boundary (S:C) with high confidentiality and integrity impact but no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 12:17 EUVD

Analysis Generated

Aug 10, 2026 - 11:15 vuln.today

CVE Published

Aug 10, 2026 - 10:40 cve.org

CRITICAL 9.6

DescriptionCVE.org

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource. The server/routers/resource/authWithAccessToken.ts handler calls verifyResourceAccessToken() without passing the target resourceId, so a valid token scoped to resource X in organization A passes verification for resource Y in organization B.

AnalysisAI

Cross-tenant authorization bypass in fosrl Pangolin through v1.20.0 lets an authenticated user reuse an access token minted for one resource to authenticate against any other resource in any organization. Because the authWithAccessToken.ts handler validates the token without binding it to the requested resourceId, a token scoped to resource X in organization A is accepted for resource Y in organization B, collapsing multi-tenant isolation. Rated CVSS 9.6 (CWE-639); no public exploit identified at time of analysis, though the vulnerable code path is disclosed in the referenced source file.

Technical ContextAI

Pangolin is a self-hosted tunneled reverse-proxy / identity-aware access platform that gates internal resources behind per-resource access tokens, organized into multi-tenant organizations. The defect is CWE-639 (Authorization Bypass Through User-Controlled Key): the server-side handler server/routers/resource/authWithAccessToken.ts invokes verifyResourceAccessToken() but omits the target resourceId argument, so the verification proves only that the token is a valid, signed, unexpired credential - not that it was issued for the resource actually being requested. The resource identifier is effectively attacker-controlled while the token remains constant, so the authorization decision is decoupled from the object being authorized. Per the CPE cpe:2.3:a:fosrl:pangolin, all versions up to and including 1.20.0 expose this handler.

RemediationAI

No vendor-released patch version is identified in the available data, so the fixed release cannot be cited precisely; monitor the fosrl/pangolin repository (https://github.com/fosrl/pangolin) for a tagged release above v1.20.0 that modifies server/routers/resource/authWithAccessToken.ts to pass the target resourceId into verifyResourceAccessToken(). As an interim compensating control, deploy a corrected build from source that enforces token-to-resourceId binding in the handler, or gate resource-token authentication behind an upstream authorization layer that re-checks the requested resource against the token's intended scope; the trade-off is added operational maintenance and potential drift from official releases. Where feasible, restrict issuance and lifetime of resource access tokens and segment organizations onto separate Pangolin instances so a cross-tenant replay cannot span them, at the cost of higher deployment overhead and reduced multi-tenant consolidation.