Executive brief
Casdoor is an open-source identity and access management (IAM) platform used to manage user authentication and authorization. A critical vulnerability in version 4.4.0 and earlier allows attackers with valid credentials from any application to bypass authorization controls and gain full administrative access to all users across all organizations—enabling them to enumerate user records, create admin accounts, modify or delete users without restriction.
Technical details
The vulnerability is an authorization bypass in the /api/mcp endpoint that fails to properly validate whether a requestor has permission to perform administrative actions across organizations. An attacker who possesses a valid clientId and clientSecret from any registered application can authenticate to the endpoint and perform privileged operations (user enumeration, creation of administrator accounts, modification, and deletion of users) on any organization's data. The flaw exists in the authorization logic (authz.go) which does not properly enforce per-organization access controls. No client-side action or additional authentication is required beyond possession of valid application credentials. Patches addressing this authorization bypass are expected in versions after 4.4.0.
Affected products
- Casdoor Casdoor through 4.4.0
Timeline
- 2026-09-15: disclosed