Description

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource. The server/routers/resource/authWithAccessToken.ts handler calls verifyResourceAccessToken() without passing the target resourceId, so a valid token scoped to resource X in organization A passes verification for resource Y in organization B.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-10T11:17:28.837Z",
  "pubdate": "2026-08-10T11:17:28.837Z",
  "executiveSummary": "An improper authorization vulnerability exists in fosrl/pangolin through v1.20.0, allowing an authenticated remote attacker to execute unauthorized authentication bypasses across arbitrary resources and organizations.\nThe vulnerability stems from flawed access token validation within the routing and authorization logic, specifically failing to bind validated tokens to specific target resources during verification.\nThis flaw allows an attacker who possesses a valid access token scoped to a specific resource within one organization to successfully reuse that exact token to authenticate against entirely different resources located in separate organizations.\nThe risk implication is severe, as it enables unauthorized cross-organization and cross-resource access, entirely breaking multi-tenancy isolation and resource boundary enforcement.\nExploitation requires the attacker to possess an authenticated session or valid access token for at least one resource, which is then replayed against unauthorized targets.\nSystems running fosrl/pangolin up to version v1.20.0 are directly affected and exposed to this remote attack vector.",
  "technicalDetails": "The root cause of the vulnerability resides in the server/routers/resource/authWithAccessToken.ts handler within the fosrl/pangolin codebase.\nSpecifically, the handler invokes the verifyResourceAccessToken() function without providing the mandatory target resourceId parameter.\nBecause the target resource identifier is omitted during the cryptographic or state validation check, the verification routine merely validates the structural integrity and validity of the token itself, completely ignoring the contextual scope for which the token was originally issued.\nConsequently, a valid access token scoped specifically to resource X in organization A successfully passes verification when presented to access resource Y in organization B.\nThe attack flow proceeds as follows: First, the authenticated attacker obtains a legitimate access token for a resource to which they legitimately hold access. Second, the attacker formulates an HTTP request targeting a distinct resource or an entirely different organization that they are unauthorized to access. Third, the attacker injects the reused access token into the request headers or parameters. Fourth, the server routes the request to server/routers/resource/authWithAccessToken.ts, which executes verifyResourceAccessToken() without checking the target resource context. Fifth, the server incorrectly accepts the token as valid for the new context, granting the attacker unauthorized access to the target resource.\nThe affected component is the resource access token verification handler located at server/routers/resource/authWithAccessToken.ts in fosrl/pangolin versions through v1.20.0.\nThe vulnerability is exploitable remotely over the network by an authenticated attacker who possesses valid credentials or an initial access token for any resource within the application.\nNo special privileges beyond standard authentication to an arbitrary, unrelated resource within the deployment are required to mount this cross-organization attack.\nPost-exploitation impact includes complete compromise of multi-tenant segregation, unauthorized data disclosure, lateral movement across organizations, and unauthorized execution or manipulation of sensitive resources belonging to other tenants."
}