CVE-2026-3209
Received Received - Intake
Improper Access Control in fosrl Pangolin Role Handler

Publication date: 2026-02-25

Last updated on: 2026-04-29

Assigner: VulDB

Description
A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiKeyRoleAccess of the component Role Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.4-s.4 mitigates this issue. The identifier of the patch is 5e37c4e85fae68e756be5019a28ca903b161fdd5. Upgrading the affected component is advised.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-25
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-02-26
EPSS Evaluated
2026-06-14
NVD
CVE-2026-3209
EUVD
EUVD-2026-8779
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
fosrl pangolin to 1.15.4-s.4 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the fosrl Pangolin software up to version 1.15.4-s.3, specifically in the Role Handler component's functions verifyRoleAccess and verifyApiKeyRoleAccess. It allows an attacker to manipulate these functions, leading to improper access controls. This means unauthorized users might gain access to resources or actions they should not have permission for. The vulnerability can be exploited remotely.

The issue has been publicly disclosed and a patch is available in version 1.15.4-s.4, which is recommended to mitigate the vulnerability.

Impact Analysis

The vulnerability can lead to improper access controls, meaning attackers could gain unauthorized access to parts of the system or data they should not be able to access. This could result in data exposure, unauthorized actions, or other security breaches depending on what the compromised access allows.

Since the exploit can be performed remotely, it increases the risk of attack without needing physical access to the system.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade the affected fosrl Pangolin component to version 1.15.4-s.4.

This upgrade addresses the improper access control issue in the verifyRoleAccess/verifyApiKeyRoleAccess functions of the Role Handler component.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3209. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart