CVE-2026-72001 Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint
Unauthenticated attackers can bypass authentication and access arbitrary protected resources across organizations by manipulating share-link parameters.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72001?
CVE-2026-72001 is a high-severity authentication bypass vulnerability in Pangolin, published on 31 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token verification call. Attackers holding a single valid share link for any resource can authenticate against arbitrary resources across different organizations, bypassing all configured authentication methods including SSO, resource passwords, PIN codes, email allowlists, and header authentication.
Weakness: CWE-639
Which versions are affected by CVE-2026-72001?
How do I fix CVE-2026-72001?
No fix has been published for CVE-2026-72001 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-72001 being exploited?
There is no known exploitation of CVE-2026-72001 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-gqgf-x763-r89w.