CVE-2026-72001

Name of the Vulnerable Software and Affected Versions Pangolin versions prior to 1.22.0

Description An authentication bypass exists that allows unauthenticated attackers to access protected resources. By providing an attacker-controlled URL parameter to the share-link authentication endpoint, the expected resource identifier is omitted from the token verification call. An attacker with a single valid share link for any resource can authenticate against arbitrary resources across different organizations, bypassing SSO, resource passwords, PIN codes, email allowlists, and header authentication.

Recommendations Update Pangolin to version 1.22.0 or later.