CVE-2026-3209

Received Received - Intake

Improper Access Control in fosrl Pangolin Role Handler

Publication date: 2026-02-25

Last updated on: 2026-04-29

Assigner: VulDB

Description

A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiKeyRoleAccess of the component Role Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.4-s.4 mitigates this issue. The identifier of the patch is 5e37c4e85fae68e756be5019a28ca903b161fdd5. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-25

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2026-02-26

EPSS Evaluated

2026-07-05

NVD

CVE-2026-3209

EUVD

EUVD-2026-8779

Affected Vendors & Products

Vendor	Product	Version / Range
fosrl	pangolin	to 1.15.4-s.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the fosrl Pangolin software up to version 1.15.4-s.3, specifically in the Role Handler component's functions verifyRoleAccess and verifyApiKeyRoleAccess. It allows an attacker to manipulate these functions, leading to improper access controls. This means unauthorized users might gain access to resources or actions they should not have permission for. The vulnerability can be exploited remotely.

The issue has been publicly disclosed and a patch is available in version 1.15.4-s.4, which is recommended to mitigate the vulnerability.

Impact Analysis

The vulnerability can lead to improper access controls, meaning attackers could gain unauthorized access to parts of the system or data they should not be able to access. This could result in data exposure, unauthorized actions, or other security breaches depending on what the compromised access allows.

Since the exploit can be performed remotely, it increases the risk of attack without needing physical access to the system.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade the affected fosrl Pangolin component to version 1.15.4-s.4.

This upgrade addresses the improper access control issue in the verifyRoleAccess/verifyApiKeyRoleAccess functions of the Role Handler component.

Hi! I’m here to help you understand CVE-2026-3209. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70