9.9
Critique
CVE-2026-15630 A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any…
Description
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| casdoor 4.2 | premières → < 4.2.0 | 4.2.0 |
Autres CVE de casdoor
Les 15 CVE de casdoor →
CVE-2026-91998
Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with…
9.4
Critique
CVE-2026-90942
Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and…
9.3
Critique
CVE-2026-9098
In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed…
9.1
Critique
CVE-2026-9097
Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active
9.8
Critique