Executive brief
Casdoor is an open-source identity and access management (IAM) server that handles user authentication and authorization. A vulnerability in the upload-resource API endpoint allows unauthenticated remote attackers to upload resources without proper credentials, potentially enabling unauthorized file storage and system compromise. This bypasses core security controls intended to restrict resource uploads to authorized users.
Technical details
The vulnerability is a missing authentication check in the upload-resource API endpoint within the controllers/resource.go file of Casdoor up to version 4.0.0. The flaw allows an unauthenticated, network-accessible attacker to directly invoke the resource upload functionality without providing valid credentials. This authentication bypass can be exploited remotely without any user interaction or prior authentication requirements. An attacker can upload arbitrary files to the Casdoor instance, potentially leading to remote code execution, data injection, or system compromise depending on how uploaded files are processed. Patches or mitigations from the vendor are not publicly documented; the vendor reportedly deleted the disclosure issue on GitHub without responding to early disclosure notification.
Affected products
- Casdoor Casdoor up to 4.0.0
Timeline
- 2026-09-01: disclosed
- other: Vendor deleted GitHub issue and did not respond to early disclosure notification