9.4
Critical
CVE-2026-91998 Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with…
Description
Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password salts and email addresses, create administrator accounts, modify existing users, and delete them in any organization by supplying legitimate credentials from a single application.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| casdoor 4.4 | earliest → 4.4.0 | No fix stated |
Other CVEs of casdoor
The 15 CVEs of casdoor →
CVE-2026-90942
Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and…
9.3
Critical
CVE-2026-15630
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any…
9.9
Critical
CVE-2026-9098
In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed…
9.1
Critical
CVE-2026-9097
Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active
9.8
Critical