CVE-2026-72564: Fosrl Pangolin

Critical severity, CVSS 9.6. EPSS: 0.4% chance of exploitation in the next 30 days.

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource.

Affected products

• Fosrl Pangolin: up to and including 1.20.0

Published 2026-08-10. Last modified 2026-08-28.