The vulnerability arises from improper authorization in the fosrl/pangolin product through version 1.20.0. Specifically, the server handler responsible for authenticating access tokens (authWithAccessToken.ts) calls verifyResourceAccessToken() without specifying the target resourceId. As a result, a valid access token scoped to one resource in one organization can be used to authenticate to a different resource in another organization. This flaw allows an authenticated remote attacker to bypass authorization controls and gain unauthorized access to resources across organizational boundaries.

An attacker with any valid access token can escalate privileges by accessing resources they are not authorized for, potentially leading to full compromise of data confidentiality and integrity within multiple organizations. The vulnerability does not affect availability. The CVSS 3.1 score of 9.6 reflects the critical impact on confidentiality and integrity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access tokens to minimal scopes and monitor for suspicious token reuse patterns. Avoid sharing tokens across resources or organizations. Follow vendor updates closely for an official fix.