CVE-2026-72001
HIGH 1 PoC
MEDIUM
Priority: 0.04
BB Relevance:
77/100
Published: 2026-08-31
Modified: 2026-11-08
First seen: 2026-11-08
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
AT:
None
VC:
High
VI:
High
VA:
None
Description
Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token verification call. Attackers holding a single valid share link for any resource can authenticate against arbitrary resources across different organizations, bypassing all configured authentication methods including SSO, resource passwords, PIN codes, email allowlists, and header authentication.
Weakness Classification (1)
References & Advisories (2)
third-party-advisory
release-notes