CVE-2026-72001

HIGH 8.1

Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token verification call. Attackers holding a single valid share link for any resource can authenticate against arbitrary resources across different organizations, bypassing all configured authentication methods including SSO, resource passwords, PIN codes, email allowlists, and header authentication.

CWE	CWE-639
Vendor	pangolin
Product	pangolin
Published	Aug 31, 2026
Last Updated	Aug 31, 2026

Stay Ahead of the Next One

Get instant alerts for pangolin pangolin

Be the first to know when new high vulnerabilities affecting pangolin pangolin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

Pangolin / Pangolin

0 < 1.22.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/fosrl/pangolin/releases/tag/1.22.0 vulncheck.com: https://www.vulncheck.com/advisories/pangolin-authentication-bypass-via-share-link-endpoint

Credits

Asadbek Fatullayev VulnCheck