External risk intelligence

Improper Authorization in fosrl/pangolin Allows Token Reuse Across Organizations

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-72564

The vulnerability exists in an authentication handler for a resource/API component in a web-based application. Such services are commonly deployed as internet-facing APIs or web services, making them reachable and exploitable by authenticated remote users in many typical deployment scenarios.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical authentication flaw has been identified in the pangolin software, potentially allowing unauthorized access across different organizations by reusing existing access tokens. This vulnerability could enable an authenticated user to access any resource, regardless of their initial permissions.

Authenticated users may access any system resource.
Matters because it bypasses access controls.
Confirm relevance and exposure of this authentication flaw.

Attack Path

How an attacker could exploit the issue

An attacker who has obtained a valid access token for one resource can use it to impersonate any other resource within any organization. This occurs because the authorization check within the `authWithAccessToken.ts` handler fails to verify the token against the intended target resource, allowing the token to be reused across different scopes. When successful, this vulnerability can lead to unauthorized access and modification of data across unrelated resources and organizations.

Authenticated remote attacker.
Reusing an access token for any resource.
Unauthorized access to any resource.

Live Threat

Current exploitation, exposure, and threat context

An authenticated attacker could gain unauthorized access to any resource within any organization by reusing a previously issued access token. This occurs because the system incorrectly verifies access tokens, allowing them to be used for resources they were not originally intended for.

System data and user data could be accessed.
Reusing an access token bypasses authorization checks.
Unauthorized access to all resources and organizations.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world response for this critical vulnerability likely falls to platform or application owners, with support from network and security teams. The first practical step is to identify all instances of the affected technology, confirm their exposure and business criticality, and then assign ownership for remediation planning.

Platform or application teams own resolution.
Verify affected technology reachability and impact.
Plan remediation based on confirmed business risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is fosrl/pangolin?

Pangolin is an open-source software framework typically used for building web services and managing resource access. It provides components for handling API requests and authentication, often serving as a backend foundation for organizations to manage data and interact with various system resources.

What does CVE-2026-72564 mean?

This CVE identifies an improper authorization vulnerability, specifically classified as CWE-639 (Authorization Bypass Through User-Controlled Key). In plain English, the software fails to properly check if a user's access token is actually authorized for the specific resource they are trying to reach, effectively trusting a token meant for one place to unlock access to another.

How can an attacker trigger this vulnerability?

An attacker needs an existing, valid access token from the system to exploit this. They trigger the flaw by presenting this token when requesting a resource different from the one the token was originally issued for. Importantly, a user cannot trigger this without being authenticated first; it is not a bug that allows anonymous access.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal flags this as 'Likely' to be relevant for many environments because Pangolin is frequently used in web-based applications and internet-facing APIs. If your instance is reachable over the network by remote users, it is considered more exposed than a system kept entirely on an internal, isolated network.

What steps should I take if I use pangolin?

Begin by creating an inventory of all systems in your environment that utilize the pangolin framework. Once identified, evaluate their network placement and business impact to prioritize them. Coordinate with your development or platform engineering teams to review the authentication logic and prepare for updates once a formal patch becomes available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.