9.9
Critical
CVE-2026-15630 A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any…
Description
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| casdoor 4.2 | earliest → < 4.2.0 | 4.2.0 |
Other CVEs of casdoor
The 15 CVEs of casdoor →
CVE-2026-91998
Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with…
9.4
Critical
CVE-2026-90942
Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and…
9.3
Critical
CVE-2026-9098
In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed…
9.1
Critical
CVE-2026-9097
Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active
9.8
Critical