CVE-2026-3209: Pangolin Auth Bypass Vulnerability

CVE-2026-3209 Overview

A vulnerability has been identified in fosrl Pangolin versions up to 1.15.4-s.3, affecting the verifyRoleAccess and verifyApiKeyRoleAccess functions within the Role Handler component. This improper access control flaw allows authenticated remote attackers to manipulate role verification logic, potentially bypassing authorization checks and gaining unauthorized access to protected resources.

Critical Impact

Remote attackers with low privileges can exploit improper role ID processing in the Role Handler component to bypass access controls, potentially leading to unauthorized data access and privilege escalation.

Affected Products

• fosrl Pangolin versions up to 1.15.4-s.3
• Applications using the verifyRoleAccess middleware
• Applications using the verifyApiKeyRoleAccess middleware

Discovery Timeline

• February 25, 2026 - CVE-2026-3209 published to NVD
• February 25, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3209

Vulnerability Analysis

This vulnerability stems from improper handling of role ID parameters in the authentication middleware. The affected functions verifyRoleAccess and verifyApiKeyRoleAccess fail to properly prioritize role ID sources, allowing attackers to inject arbitrary role IDs through the request body even when a specific role ID is provided in URL parameters or query strings. This logic flaw creates a condition where user-supplied roleIds in the request body can override legitimate role verification, effectively bypassing access control checks.

The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment), indicating that the system incorrectly assigns privileges to roles during the verification process. An attacker with valid low-level credentials can craft malicious requests to access resources beyond their authorized scope.

Root Cause

The root cause lies in the flawed conditional logic for processing role IDs. The original implementation used a fallback pattern that inadvertently allowed the req.body.roleIds array to take precedence over explicitly provided single role IDs. When singleRoleId was provided via URL parameters but roleIds was also present in the request body, the code would process the body-supplied array instead of the intended single role ID, creating an authorization bypass condition.

Attack Vector

The attack is network-based and can be executed remotely by authenticated users with low-privilege access. The exploitation requires no user interaction and targets the Role Handler middleware during API requests. An attacker can craft HTTP requests containing manipulated roleIds arrays in the request body to override legitimate role verification, allowing access to resources associated with other roles.

The following patches demonstrate the security fix applied in version 1.15.4-s.4:

Patch for verifyApiKeyRoleAccess.ts:

             );
         }
 
-        const { roleIds } = req.body;
-        const allRoleIds =
-            roleIds || (isNaN(singleRoleId) ? [] : [singleRoleId]);
+        let allRoleIds: number[] = [];
+        if (!isNaN(singleRoleId)) {
+            // If roleId is provided in URL params, query params, or body (single), use it exclusively
+            allRoleIds = [singleRoleId];
+        } else if (req.body?.roleIds) {
+            // Only use body.roleIds if no single roleId was provided
+            allRoleIds = req.body.roleIds;
+        }
 
         if (allRoleIds.length === 0) {
             return next();

Source: GitHub Pangolin Commit

Patch for verifyRoleAccess.ts:

         );
     }
 
-    const roleIds = req.body?.roleIds;
-    const allRoleIds = roleIds || (isNaN(singleRoleId) ? [] : [singleRoleId]);
+    let allRoleIds: number[] = [];
+    if (!isNaN(singleRoleId)) {
+        // If roleId is provided in URL params, query params, or body (single), use it exclusively
+        allRoleIds = [singleRoleId];
+    } else if (req.body?.roleIds) {
+        // Only use body.roleIds if no single roleId was provided
+        allRoleIds = req.body.roleIds;
+    }
 
     if (allRoleIds.length === 0) {
         return next();

Source: GitHub Pangolin Commit

Detection Methods for CVE-2026-3209

Indicators of Compromise

• Unusual API requests containing roleIds arrays in request bodies when single role ID parameters are expected
• Access logs showing users accessing resources outside their assigned role scope
• Authentication logs with mismatched role assertions between URL parameters and request body content

Detection Strategies

• Implement API request monitoring to detect anomalous roleIds array submissions in authenticated requests
• Deploy web application firewall (WAF) rules to flag requests containing both URL-based role IDs and body-based roleIds arrays
• Review access control logs for patterns indicating unauthorized resource access across role boundaries
• Audit application logs for failed or suspicious role verification attempts

Monitoring Recommendations

• Enable detailed logging for the verifyRoleAccess and verifyApiKeyRoleAccess middleware functions
• Configure alerting for access control exceptions or authorization failures in the Role Handler component
• Monitor for elevated API activity from low-privilege accounts accessing restricted endpoints
• Implement real-time analysis of request patterns to identify potential exploitation attempts

How to Mitigate CVE-2026-3209

Immediate Actions Required

• Upgrade fosrl Pangolin to version 1.15.4-s.4 or later immediately
• Review access logs for evidence of exploitation prior to patching
• Audit user permissions and role assignments to identify any unauthorized access
• Implement additional input validation on role-related API endpoints as a defense-in-depth measure

Patch Information

The vulnerability is addressed in fosrl Pangolin version 1.15.4-s.4. The fix is contained in commit 5e37c4e85fae68e756be5019a28ca903b161fdd5, which corrects the role ID processing logic to properly prioritize single role IDs from URL parameters over body-supplied arrays. Organizations should upgrade to the patched version as the recommended remediation. For detailed patch information, refer to the GitHub Pangolin Pull Request and the official release.

Workarounds

• Implement custom middleware validation to ensure roleIds arrays in request bodies are stripped when URL-based role parameters are present
• Deploy API gateway rules to sanitize incoming requests and remove potentially conflicting role ID parameters
• Restrict network access to affected endpoints until the patch can be applied
• Implement additional authorization checks at the business logic layer as a secondary control

# Configuration example - Update Pangolin to patched version
npm update @fosrl/pangolin@1.15.4-s.4

# Verify installed version
npm list @fosrl/pangolin

# Alternative: Apply patch directly from commit
git fetch origin
git cherry-pick 5e37c4e85fae68e756be5019a28ca903b161fdd5