Read the docs
TI-2026-02772 Aliases CVE-2026-3209GHSA-jv85-6mgr-3w99

fosrl Pangolin Role verifyApiKeyRoleAccess access control

Priority MEDIUM 57CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266 and CWE-284.

Summary

A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiKeyRoleAccess of the component Role Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.4-s.4 mitigates this issue. The identifier of the patch is 5e37c4e85fae68e756be5019a28ca903b161fdd5. Upgrading the affected component is advised.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00345 28th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Pangolin (fosrl): 1.15.4-s.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fosrlPangolin1.15.4-s.0; 1.15.4-s.1; 1.15.4-s.2; 1.15.4-s.31.15.4-s.4Patch availableCNA
  • Pangolin Vendorfosrl Affected 1.15.4-s.0; 1.15.4-s.1; 1.15.4-s.2; 1.15.4-s.3 Fixed in 1.15.4-s.4 Patch available CNA

Remediation

  • Fix · CNA Pangolin (fosrl) Fixed in 1.15.4-s.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-3209
  2. 2026-10-03 Alias added: GHSA-jv85-6mgr-3w99

References

Exploit 1

Patch 3

Other 1

  • TI-2026-50823 fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication CVSS 3.1CRITICAL 9.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences