# CVE-2026-15630: Casdoor cross-tenant authorization bypass in multiple API endpoints

Source: https://junglewise.ai/threats/cve-2026-15630-casdoor-cross-tenant-authorization-bypass-in-multiple-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-15630 · Severity: info · CVSS 9.6 · Published 2026-07-23

Casdoor, an open-source identity and access management platform, contains a critical vulnerability that allows an administrator of one organization to manage resources in any other organization on the same server. By sending specially crafted requests, a malicious tenant admin can delete users, create new unauthorized administrators, or steal control of the entire system. This effectively breaks the security boundaries between different customers or departments using the same Casdoor instance, leading to potential data loss and full account takeovers.

## Quick answers

**Is CVE-2026-15630 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15630 being exploited in the wild.

**How severe is CVE-2026-15630?** Informational severity, with a CVSS score of 9.6, published 23 July 2026.

**Which products and versions are affected?** Casdoor Casdoor Through v3.115.0.

**Is there a fix for CVE-2026-15630?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15630 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-15630?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A systemic authorization bypass exists in Casdoor (up to v3.115.0) due to a mismatch in how the global authorization filter and individual API controllers resolve target objects. The authorization filter (`routers/authz_filter.go`) validates permissions based on the `?id=` query parameter, while approximately 25 controllers (including `controllers/user.go` and `controllers/permission.go`) ignore this parameter and perform actions based on the `owner` and `name` fields within the JSON request body. An attacker with organization-admin privileges (`IsAdmin = true`) can provide a legitimate ID in the URL to pass the filter while specifying a victim's resource in the request body. This allows for cross-tenant resource deletion, creation of backdoor administrators, and escalation to global instance-wide privileges via Casbin rule injection. No patch was available at the time of disclosure.

## Affected products

- Casdoor Casdoor Through v3.115.0

## Timeline

- 2026-07-12: other: Vulnerability re-verified against master branch
- 2026-07-20: disclosed: Voke Cyber published research advisory
- 2026-07-23: advisory: CVE-2026-15630 published to NVD

## References

- [https://vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz](https://vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz)