CVE-2026-5469
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Casdoor 2.356.0 has a server-side request forgery (SSRF) vulnerability in the Webhook URL Handler component. The attack can be launched remotely without authentication.
Risk Assessment
An attacker can use the server to send requests to internal network resources, potentially leading to data leakage or further compromise.
Recommendation
Contact the vendor for a patch or consider temporarily disabling the webhook functionality.
Original NVD description (English source)
A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.