CVE-2025-61524
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
In Casdoor version 2.26.0 and earlier, a vulnerability in the permission verification module and organization/application editing interface allows remote authenticated administrators of any organization to bypass the system's permission verification mechanism by directly concatenating URLs after login. The issue is fixed in version 2.63.0.
Risk Assessment
The risk involves potential unauthorized access to administrative functions and data of other organizations within the system, which could lead to breach of inter-organizational isolation and privilege escalation.
Recommendation
Immediately upgrade Casdoor to version 2.63.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Casdoor
See all- CVE-2026-32662Medium
Development and test API endpoints that mirror production functionality are present in the application. This means they may be accessible in the production environment, posing a risk of unauthorized access.
- CVE-2026-5469Medium
Casdoor 2.356.0 has a server-side request forgery (SSRF) vulnerability in the Webhook URL Handler component. The attack can be launched remotely without authentication.
- CVE-2026-5468Low
In Casdoor version 2.356.0, the dangerouslySetInnerHTML function is vulnerable to cross-site scripting via manipulation of the formCss, formCssMobile, or formSideHtml arguments. The attack can be launched remotely, and the exploit has been publicly released. The vendor did not respond.
- CVE-2026-5467Medium
A vulnerability was identified in Casdoor 2.356.0 in the OAuth Authorization Request Handler. Manipulation of the redirect_uri argument leads to an open redirect. The attack can be performed remotely and the exploit is publicly available.
- CVE-2023-34927Medium
Casdoor v1.331.0 and below was found to contain a Cross-Site Request Forgery (CSRF) vulnerability in the /api/set-password endpoint. This vulnerability allows attackers to arbitrarily change the victim user's password by supplying a crafted URL.
Original NVD description (English source)
An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remote authenticated administrators of any organization within the system to bypass the system's permission verification mechanism by directly concatenating URLs after login