Is CVE-2026-5468 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5468 being exploited in the wild.

How severe is CVE-2026-5468?

Low severity, with a CVSS score of 3.5, published 3 April 2026.

Which products and versions are affected?

Casbin Casdoor <= 1.1000.0, 2.356.0; github.com/casdoor/casdoor (Go) <= 1.1000.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1000.0.

Is there a fix for CVE-2026-5468?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5468 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-5468?

Check whether you run Casbin Casdoor or github.com/casdoor/casdoor (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5468: Casbin Casdoor cross site scripting in dangerouslySetInnerHTML

Q: Which products and versions are affected?

Casbin Casdoor <= 1.1000.0, 2.356.0; github.com/casdoor/casdoor (Go) <= 1.1000.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1000.0.

Q: Is there a fix for CVE-2026-5468?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-5468 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-5468?

Check whether you run Casbin Casdoor or github.com/casdoor/casdoor (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5468 · Severity: low · CVSS 3.5 · Published 2026-04-03

Casdoor, an open-source identity and access management platform, contains a security vulnerability that allows for cross-site scripting (XSS). An attacker can exploit this by injecting malicious code into specific form configuration fields, which then executes in the browser of other users. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Technologies: Casbin Casdoor, github.com/casdoor/casdoor (Go). Vendors: Casbin, Go.

Quick answers

Is CVE-2026-5468 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5468 being exploited in the wild.
How severe is CVE-2026-5468?: Low severity, with a CVSS score of 3.5, published 3 April 2026.
Which products and versions are affected?: Casbin Casdoor <= 1.1000.0, 2.356.0; github.com/casdoor/casdoor (Go) <= 1.1000.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1000.0.
Is there a fix for CVE-2026-5468?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5468 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-5468?: Check whether you run Casbin Casdoor or github.com/casdoor/casdoor (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A cross-site scripting (XSS) vulnerability exists in Casdoor 2.356.0 due to the unsafe use of the dangerouslySetInnerHTML function in the frontend. The vulnerability is triggered by manipulating the formCss, formCssMobile, or formSideHtml arguments, which lack proper input sanitization. An attacker with low-level privileges can initiate this attack remotely, though it requires some user interaction (UI:R). Successful exploitation allows the execution of arbitrary script code in the context of the victim's session. While the vendor was notified, no official patch has been confirmed at the time of disclosure, and public exploit code is reportedly available.

Affected products

Casbin Casdoor 2.356.0

Identifiers

CVE-2026-5468
GHSA-w799-7525-rpr6
GO-2026-5697

Timeline

2026-04-03: disclosed: Vulnerability disclosed and CVE assigned via VulDB
2026-04-03: advisory: NVD published the advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.