Authentication Bypass in Pangolin by Fosrl

CVE-2026-72001

What is CVE-2026-72001?

Pangolin versions prior to 1.22.0 have a security flaw that permits unauthorized users to bypass authentication mechanisms. This vulnerability arises when an attacker manipulates URL parameters for the share-link authentication endpoint, leading to unauthorized access to various protected resources. Once an attacker possesses a valid share link for any resource, they can exploit this flaw to authenticate against additional resources across different organizations, defeating all predefined security measures, including single sign-on (SSO), resource passwords, and email allowlists.

References