Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token verification call. Attackers holding a single valid share link for any resource can authenticate against arbitrary resources across different organizations, bypassing all configured authentication methods including SSO, resource passwords, PIN codes, email allowlists, and header authentication.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Pangolin (Pangolin) Fixed in 1.22.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-72001
- 2026-10-03 Alias added: GHSA-gqgf-x763-r89w
References
Other 1
More Pangolin vulnerabilities
- TI-2025-35309 An issue in Fossorial fosrl/pangolin v.1.6.2 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
- TI-2025-35308 Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access… CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-72001 · CVE Program
- CVE-2026-72001 · NVD
- FIRST EPSS
- GHSA-gqgf-x763-r89w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences