CVE-2026-3209
Improper Access Control in fosrl Pangolin Role Handler
Publication date: 2026-02-25
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fosrl | pangolin | to 1.15.4-s.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the fosrl Pangolin software up to version 1.15.4-s.3, specifically in the Role Handler component's functions verifyRoleAccess and verifyApiKeyRoleAccess. It allows an attacker to manipulate these functions, leading to improper access controls. This means unauthorized users might gain access to resources or actions they should not have permission for. The vulnerability can be exploited remotely.
The issue has been publicly disclosed and a patch is available in version 1.15.4-s.4, which is recommended to mitigate the vulnerability.
How can this vulnerability impact me? :
The vulnerability can lead to improper access controls, meaning attackers could gain unauthorized access to parts of the system or data they should not be able to access. This could result in data exposure, unauthorized actions, or other security breaches depending on what the compromised access allows.
Since the exploit can be performed remotely, it increases the risk of attack without needing physical access to the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade the affected fosrl Pangolin component to version 1.15.4-s.4.
This upgrade addresses the improper access control issue in the verifyRoleAccess/verifyApiKeyRoleAccess functions of the Role Handler component.