This vulnerability (CWE-639) in fosrl Pangolin through version 1.20.0 involves improper authorization due to reuse of access tokens across different resources and organizations. An authenticated attacker can leverage a token issued for one resource to gain unauthorized access to other resources, effectively bypassing authorization checks. The CVSS 3.1 score is 9.6 (critical) with network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality and integrity impacts.

An attacker with valid authentication can access any resource in any organization by reusing an access token intended for a different resource. This leads to a complete breach of confidentiality and integrity of data and resources across organizations. Availability is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented. Until a fix is available, restrict access to trusted users and monitor for suspicious token reuse if possible.