Description

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token verification call. Attackers holding a single valid share link for any resource can authenticate against arbitrary resources across different organizations, bypassing all configured authentication methods including SSO, resource passwords, PIN codes, email allowlists, and header authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-31T19:17:10.793Z",
  "pubdate": "2026-08-31T19:17:10.793Z",
  "executiveSummary": "Pangolin versions prior to 1.22.0 are susceptible to a critical authentication bypass vulnerability within the share-link authentication endpoint. This flaw permits unauthenticated attackers to gain unauthorized access to any protected resource by manipulating URL parameters.\nThe vulnerability stems from improper validation of resource identifiers during the token verification process. By providing a crafted URL parameter, an attacker holding a single valid share link for any resource can bypass all configured security controls, including SSO, resource passwords, PIN codes, email allowlists, and header-based authentication.\nThe impact of this vulnerability is severe, as it allows for cross-organization data access and total compromise of protected resources. No elevated privileges are required to initiate an attack, as the flaw resides at the entry point of the authentication handshake. Exploitation does not require prior knowledge of the target's internal security configuration, effectively rendering perimeter defenses obsolete for affected deployments.",
  "technicalDetails": "The vulnerability is rooted in a logic flaw within the share-link authentication endpoint of the Pangolin application. Specifically, the backend mechanism responsible for validating share-link tokens fails to enforce the association between the provided token and the specific resource identifier requested by the user. When the authentication service receives a request, it performs a verification call; however, if the attacker-supplied URL parameter intentionally omits the resource identifier, the verification logic defaults to a state that erroneously validates the token against the requested resource regardless of whether the token was originally provisioned for that resource.\nThe attack flow proceeds as follows: First, an attacker obtains a single, legitimate share link for any resource accessible within the Pangolin ecosystem. This can be achieved through public discovery or previous legitimate access. Second, the attacker targets an arbitrary protected resource—which may belong to a completely different organization or contain highly sensitive, restricted data—and constructs a malicious request. This request involves appending or modifying the URL parameters to exclude the unique resource identifier that would normally tie the share link to its original target. Third, the attacker submits this modified request to the share-link authentication endpoint. The server, processing the verification call, fails to cross-reference the token's scope with the targeted resource ID due to the omission. Consequently, the authentication service returns a successful validation status, granting the attacker a session context for the unauthorized resource.\nBecause this bypass occurs at the verification layer, it effectively nullifies all secondary authentication tiers. Once the primary share-link check is bypassed, the system proceeds as if the user is authorized, ignoring subsequent requirements such as SSO, multi-factor authentication, resource-level passwords, PIN codes, or email allowlist restrictions. The vulnerability exists in all Pangolin versions prior to 1.22.0. This allows for horizontal and vertical privilege escalation, enabling attackers to harvest sensitive information from disparate organizations without ever authenticating through the intended identity provider (IdP) or internal access control lists (ACLs)."
}