CVE-2026-72564

Name of the Vulnerable Software and Affected Versions fosrl/pangolin versions prior to 1.21.0

Description An improper authorization issue allows an authenticated remote attacker to gain access to any resource within any organization by reusing an access token originally issued for a different resource. This occurs because the handler server/routers/resource/authWithAccessToken.ts invokes the verifyResourceAccessToken() function without providing the target resourceId, causing the system to validate tokens regardless of the intended resource or organization.

Recommendations Update fosrl/pangolin to version 1.21.0 or later.