Pangolin
Monthly
Authentication bypass in Pangolin before 1.22.0 allows any attacker holding a single valid share link - for any resource, in any organization - to authenticate against arbitrary protected resources by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that causes the token verification call to omit the expected resource identifier. All configured authentication layers are bypassed simultaneously, including SSO, resource passwords, PIN codes, email allowlists, and header authentication. CVSS 4.0 scores this 8.6 (High); no public exploit or CISA KEV listing has been identified at time of analysis, but the low exploitation bar - one share link from any resource - makes this a realistic threat in multi-tenant or multi-organization deployments.
Cross-tenant authorization bypass in fosrl Pangolin through v1.20.0 lets an authenticated user reuse an access token minted for one resource to authenticate against any other resource in any organization. Because the authWithAccessToken.ts handler validates the token without binding it to the requested resourceId, a token scoped to resource X in organization A is accepted for resource Y in organization B, collapsing multi-tenant isolation. Rated CVSS 9.6 (CWE-639); no public exploit identified at time of analysis, though the vulnerable code path is disclosed in the referenced source file.
Authentication bypass in Pangolin before 1.22.0 allows any attacker holding a single valid share link - for any resource, in any organization - to authenticate against arbitrary protected resources by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that causes the token verification call to omit the expected resource identifier. All configured authentication layers are bypassed simultaneously, including SSO, resource passwords, PIN codes, email allowlists, and header authentication. CVSS 4.0 scores this 8.6 (High); no public exploit or CISA KEV listing has been identified at time of analysis, but the low exploitation bar - one share link from any resource - makes this a realistic threat in multi-tenant or multi-organization deployments.
Cross-tenant authorization bypass in fosrl Pangolin through v1.20.0 lets an authenticated user reuse an access token minted for one resource to authenticate against any other resource in any organization. Because the authWithAccessToken.ts handler validates the token without binding it to the requested resourceId, a token scoped to resource X in organization A is accepted for resource Y in organization B, collapsing multi-tenant isolation. Rated CVSS 9.6 (CWE-639); no public exploit identified at time of analysis, though the vulnerable code path is disclosed in the referenced source file.