CVE-2026-72564

CVSS 9.6 (critical) · published 2026-08-10

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource.

Weakness: CWE-639

Source: NVD CVE-2026-72564

References

• https://github.com/fosrl/pangolin
• https://github.com/fosrl/pangolin/blob/main/server/routers/resource/authWithAccessToken.ts

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.