The vulnerability is an improper authorization flaw in fosrl/Pangolin that lets an authenticated attacker reuse an access token issued for one resource to authenticate to another resource. Because the token verification routine does not confirm the target resource ID, a token scoped to resource X in organization A is accepted when used to request resource Y in organization B, allowing cross‑resource access. This flaw is a classic example of CWE‑639, where authorization checks are bypassed due to user‑controlled data.

The affected product is the open‑source project fosrl/Pangolin. The vulnerability exists in all releases up through version 1.20.0, and any earlier release that has not been patched has the same issue. Users should verify that they are running a version later than 1.20.0 or have applied a patch that fixes the token validation logic.

The CVSS score of 9.6 classifies this as a critical vulnerability, with a high degree of impact and a requirement for network access as the attacker merely needs a valid token for a resource. The EPSS score is not available, and the issue is not yet listed in CISA’s KEV catalog, yet the flaw’s logic makes exploitation likely in environments where tokens are not tightly scoped or where cross‑org access is a concern. An attacker who can obtain or guess a token for one resource can immediately gain unauthorized authentication to any resource, effectively bypassing all resource‑level access controls.