CVE-2026-72564 — fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication

CVE-2026-72564

fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication PUBLISHED

Description (CNA)

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource.

Affected (CNA)

Vendor / product	Versions
fosrl / Pangolin	affected 0 through 1.20.0

CWE

CWE-639

References

https://github.com/fosrl/pangolin
https://github.com/fosrl/pangolin/blob/main/server/routers/resource/authWithAccessToken.ts

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.