Cpe:2.3:a:pangolin:pangolin:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3apangolinpangolin/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 31 Aug 2026 19:58:46 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthentication Bypass Vulnerability in Pangolinhttps://feed.craftedsignal.io/briefs/2026-08-pangolin-auth-bypass/Mon, 31 Aug 2026 19:58:46 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-pangolin-auth-bypass/Pangolin versions prior to 1.22.0 are vulnerable to an authentication bypass in the share-link endpoint, allowing unauthenticated access to arbitrary resources.Pangolin versions prior to 1.22.0 contain a critical authentication bypass vulnerability (CVE-2026-72001) within the application's share-link authentication mechanism. This flaw stems from improper input validation during the token verification process. Specifically, the share-link authentication endpoint fails to enforce the inclusion of the resource identifier in the verification call, allowing an attacker to manipulate URL parameters to gain unauthorized access to protected content. By utilizing a single valid share link - which can be obtained for any low-security resource - an attacker can bypass all configured authentication controls, including SSO, resource passwords, PIN requirements, email allowlists, and header-based authentication. This allows for unauthorized traversal and access to arbitrary resources across different organizations within the Pangolin ecosystem. The vulnerability is rated with a CVSS 3.1 base score of 8.1, indicating high risk for organizations relying on Pangolin for secure document or resource sharing.

Impact

Successful exploitation of CVE-2026-72001 grants unauthenticated attackers the ability to access any resource managed by the Pangolin platform. This potential exposure includes sensitive proprietary information, internal documents, and collaborative data protected by organizational security policies. Because the vulnerability bypasses SSO and other robust authentication layers, organizations are at immediate risk of large-scale data exfiltration and unauthorized information disclosure across multi-tenant environments.

Recommendation

  • Upgrade Pangolin to version 1.22.0 or later immediately to address the vulnerability in the share-link authentication endpoint.
  • Audit access logs for the share-link endpoints for anomalous query patterns where the resource identifier is missing or mismatched from the expected token payload.
  • Disable public share links for highly sensitive resources until the patch is applied.
]]>highadvisoryauthentication-bypasscve-2026-72001vulnerability