Executive brief
Pangolin is a platform that manages access to protected resources across organizations using share links and various authentication methods. This vulnerability allows attackers who possess even a single valid share link to bypass all authentication protections—including SSO, passwords, and PIN codes—and gain unauthorized access to any other protected resource in the system, potentially across different organizations.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the share-link authentication endpoint. The root cause is that the endpoint fails to verify the resource identifier from the attacker-supplied URL parameter during token verification, omitting the expected resource check. An attacker with a single valid share link can craft a request to the endpoint with an attacker-controlled URL parameter pointing to an arbitrary resource, and the token verification logic will succeed without validating that the token applies to that resource. The attack requires only network access and a single valid share link (no privilege escalation required), and it completely bypasses all configured authentication methods. The vulnerability was patched in version 1.22.0 released on August 27, 2026.
Affected products
- Pangolin Pangolin before 1.22.0
Timeline
- 2026-08-31: disclosed
- 2026-08-27: patched