CVE-2026-72564Disclosure

LOWCVSS 9.6 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-08-12); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Referenced assets1 URL

By indicator

https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-08-10/TIER_2_CVE-2026-72564.md

Classification over time

Date	Total	Labels

2026-08-12	1	Disclosure1
2026-08-29	1	Patch1

Full discourse2 posts

Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs50d
Disclosure
CVE-2026-72564 Pangolin Authorisation bypass could result in reuse of access tokens across organisational boundaries, weakening tenant isolation and zero-trust access controls Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-08-10/TIER_2_CVE-2026-72564.md #CyberSecurity #IdentitySecurity #VulnerabilityManagement
Post summary
The post announces CVE-2026-72564, outlining an authorization bypass that enables cross‑tenant access token reuse and weakens zero‑trust controls, but it does not provide PoC, exploit, active use, or patch details.
000103
59 followersView on X
DFIR Lab@DFIR_Lab34d
Patch
🚨 CRITICAL: CVE-2026-72564 (CVSS 9.6) - Improper authorization in fosrl/pangolin ≤v1.20.0 allows authenticated attackers to reuse access tokens across ANY resource in ANY organization. Patch immediately. #CVE #PatchNow #ThreatIntel https://t.co/PWXbi8fYNA
Post summary
The tweet announces CVE-2026-72564, a critical improper authorization flaw, and urges immediate patching.
0000035
121 followersView on X

Explore more

Back to dashboard