An authentication bypass vulnerability in Pangolin versions prior to 1.22.0 allows unauthenticated attackers to access restricted resources by manipulating share-link tokens.

This vulnerability, categorized as an authorization bypass through a user-controlled key (CWE-639), exists in the share-link authentication endpoint. By omitting the resource identifier during token verification, an unauthenticated attacker can bypass all configured authentication methods, including SSO and password protections, to access arbitrary resources.

With a CVSS score of 8.1, this vulnerability presents a severe risk to organizational data confidentiality and integrity. Attackers can gain unauthorized access to protected resources across different organizations without needing valid credentials, potentially leading to widespread data exposure and loss of trust in security controls.

Immediate Action: Update Pangolin to version 1.22.0 or later immediately to resolve the authentication logic flaw.

Proactive Monitoring: Review access logs for the share-link endpoint to identify any anomalous patterns of access or unauthorized authentication attempts.

Compensating Controls: Disable public share links for sensitive resources until the patch can be applied, and ensure that Web Application Firewalls are configured to block malformed requests to the share-link endpoint.

Public Exploit Available: No

The ability to bypass authentication entirely makes this a critical security concern. Administrators must prioritize updating to version 1.22.0 to secure their environments against unauthorized access and potential data exfiltration.