CVE-2026-72001
Received Received - Intake

Authentication Bypass in Pangolin Prior to 1.22.0

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token verification call. Attackers holding a single valid share link for any resource can authenticate against arbitrary resources across different organizations, bypassing all configured authentication methods including SSO, resource passwords, PIN codes, email allowlists, and header authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-72001
EUVD
EUVD-2026-68720

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fosrl pangolin to 1.22.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Pangolin before version 1.22.0 has an authentication bypass flaw. Unauthenticated attackers can access protected resources by manipulating a URL parameter in the share-link authentication endpoint. They omit the resource identifier from token verification, bypassing all authentication methods like SSO, passwords, PIN codes, email allowlists, and header authentication. Attackers with one valid share link can access any resource across organizations.

Detection Guidance

Check Pangolin versions prior to 1.22.0 for the vulnerability. Monitor logs for unusual authentication attempts via share-link endpoints. Inspect network traffic for requests to /share-link or similar endpoints with manipulated URL parameters.

Impact Analysis

This vulnerability allows attackers to bypass authentication and access sensitive resources without proper authorization. If you use Pangolin versions prior to 1.22.0, attackers could gain unauthorized access to your data, systems, or resources, potentially leading to data breaches, unauthorized actions, or further exploitation within your environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR, HIPAA, and other regulations. It undermines access controls, potentially resulting in data breaches, unauthorized disclosures, and failure to meet regulatory standards for data protection and access management.

Mitigation Strategies

Upgrade Pangolin to version 1.22.0 or later immediately. Disable share-link authentication endpoints if not required. Review and revoke any potentially compromised share links. Implement strict access controls and monitor for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72001. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart