# CVE-2025-61524: Casdoor improper authorization in organization and application editing interface

Source: https://junglewise.ai/threats/cve-2025-61524-casdoor-improper-authorization-in-organization-and-application  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-08. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-61524 · Severity: high · CVSS 7.2 · Published 2025-10-08

Casdoor, an open-source identity and access management platform, contains a security flaw that allows administrators of one organization to access and modify settings for other organizations. By simply entering specific web addresses, an attacker with limited administrative rights can change security configurations, set universal passwords to take over any account, or disable login services entirely. This could lead to a total system takeover or a complete shutdown of authentication services for all users.

Technologies: [github.com/casdoor/casdoor (Go)](https://junglewise.ai/threats/technologies/github-com-casdoor-casdoor). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2025-61524 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61524 being exploited in the wild.

**How severe is CVE-2025-61524?** High severity, with a CVSS score of 7.2, published 8 October 2025.

**Which products and versions are affected?** github.com/casdoor/casdoor (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.63.0.

**Is there a fix for CVE-2025-61524?** Yes. github.com/casdoor/casdoor (Go): upgrade to 2.63.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-61524 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-61524?** Check whether you run github.com/casdoor/casdoor (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/casdoor/casdoor (Go): upgrade to 2.63.0 or later

  ```sh
  go get github.com/casdoor/casdoor@v2.63.0
  ```


## Technical details

An improper authorization vulnerability (CWE-285) exists in Casdoor versions up to and including v2.62.0. The vulnerability stems from a lack of server-side permission validation in the organization and application editing interfaces. While the front-end UI hides unauthorized options, the back-end fails to verify if the authenticated requester has authority over the specific organization or application ID provided in the URL. A remote authenticated attacker with 'administrator' privileges for any single organization can exploit this by manually constructing URLs to modify configurations of other organizations. This can be used to set universal passwords, change OAuth redirection targets, or cause a denial of service by clearing application configurations. The issue was addressed in version 2.63.0 by improving the 'authz_filter' logic.

## Affected products

- Casdoor Casdoor <= v2.62.0

## Identifiers

- CVE-2025-61524
- GHSA-5m9m-j5p7-m7f9
- GO-2025-4026

## Timeline

- 2025-09-18: patched: Fix released in version 2.63.0
- 2025-10-08: disclosed: Public disclosure and CVE assignment

## References

- [https://gist.github.com/DevHjz/e75cea851d48e5f5478ac2a90757851a](https://gist.github.com/DevHjz/e75cea851d48e5f5478ac2a90757851a)
- [https://github.com/casdoor/casdoor/commit/d883db907bb6e0b95737ef8e8b57b7da9078cbdd](https://github.com/casdoor/casdoor/commit/d883db907bb6e0b95737ef8e8b57b7da9078cbdd)
- [https://github.com/casdoor/casdoor/releases/tag/v2.63.0](https://github.com/casdoor/casdoor/releases/tag/v2.63.0)

## Related threats

- [Casdoor SAML response validation bypass in auth controller](https://junglewise.ai/threats/cve-2026-9098-casdoor-saml-response-validation-bypass-in-auth-controller)
- [Casdoor missing JWT revocation check in token exchange](https://junglewise.ai/threats/cve-2026-9097-casdoor-missing-jwt-revocation-check-in-token-exchange)
- [Casdoor SAML assertion time bound enforcement failure](https://junglewise.ai/threats/cve-2026-9096-casdoor-saml-assertion-time-bound-enforcement-failure)
- [Casdoor cross-organization token exchange privilege escalation](https://junglewise.ai/threats/cve-2026-9094-casdoor-cross-organization-token-exchange-privilege-escalation)
- [Casdoor SAML audience restriction bypass](https://junglewise.ai/threats/cve-2026-9093-casdoor-saml-audience-restriction-bypass)