Executive brief
Casdoor, an open-source identity and access management platform, contains a critical vulnerability that allows an administrator of one organization to manage resources in any other organization on the same server. By sending specially crafted requests, a malicious tenant admin can delete users, create new unauthorized administrators, or steal control of the entire system. This effectively breaks the security boundaries between different customers or departments using the same Casdoor instance, leading to potential data loss and full account takeovers.
Technical details
A systemic authorization bypass exists in Casdoor (up to v3.115.0) due to a mismatch in how the global authorization filter and individual API controllers resolve target objects. The authorization filter (`routers/authz_filter.go`) validates permissions based on the `?id=` query parameter, while approximately 25 controllers (including `controllers/user.go` and `controllers/permission.go`) ignore this parameter and perform actions based on the `owner` and `name` fields within the JSON request body. An attacker with organization-admin privileges (`IsAdmin = true`) can provide a legitimate ID in the URL to pass the filter while specifying a victim's resource in the request body. This allows for cross-tenant resource deletion, creation of backdoor administrators, and escalation to global instance-wide privileges via Casbin rule injection. No patch was available at the time of disclosure.
Affected products
- Casdoor Casdoor Through v3.115.0
Timeline
- 2026-07-12: other: Vulnerability re-verified against master branch
- 2026-07-20: disclosed: Voke Cyber published research advisory
- 2026-07-23: advisory: CVE-2026-15630 published to NVD