A vulnerability in the Role Handler of fosrl Pangolin software allows an attacker to manipulate the verifyRoleAccess and verifyApiKeyRoleAccess endpoints, resulting in improper access controls. By exploiting this flaw, a remote attacker can bypass intended permission checks and gain unauthorized access to privileged resources or actions. The weakness stems from a missing validation of role or API‑key permissions, mapping to CWE‑266 and CWE‑284.

The flaw affects all releases of fosrl Pangolin up to and including version 1.15.4‑s.3. Systems running any affected build are at risk until the component is upgraded to 1.15.4‑s.4, the first release containing the fix identified by commit 5e37c4e85fae68e756be5019a28ca903b161fdd5.

The CVSS score of 5.3 indicates a moderate risk, while the EPSS value below 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but remote exploitation is possible through the exposed API. Attackers would need network access to the Pangolin instance and the ability to craft requests to the role verification endpoints, after which they could elevate privileges or access restricted data.