CVE-2026-91998
CriticalCVSS 9.9Summary
Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password salts and email addresses, create administrator accounts, modify existing users, and delete them in any organization.
Risk Assessment
Full takeover of user administration across all organizations and leakage of sensitive data such as password salts and email addresses are possible. The risk is critical for environments using Casdoor for identity management.
Recommendation
Upgrade Casdoor to a version later than 4.4.0 if available. Until then, restrict access to the /api/mcp endpoint and rotate application credentials.
Other vulnerabilities in Casdoor
See all- CVE-2026-90942Critical
Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization, including global administrators.
- CVE-2026-84423High
A vulnerability in Casdoor up to version 4.0.0 affects an unknown function in the file controllers/resource.go of the upload-resource API component. This manipulation leads to missing authentication, and the attack can be launched remotely. The exploit has been publicly disclosed, and the vendor deleted the GitHub issue without explanation and did not respond to email contact.
- CVE-2026-32662Medium
Development and test API endpoints that mirror production functionality are present in the application. This means they may be accessible in the production environment, posing a risk of unauthorized access.
- CVE-2026-5469Medium
Casdoor 2.356.0 has a server-side request forgery (SSRF) vulnerability in the Webhook URL Handler component. The attack can be launched remotely without authentication.
- CVE-2026-5468Low
In Casdoor version 2.356.0, the dangerouslySetInnerHTML function is vulnerable to cross-site scripting via manipulation of the formCss, formCssMobile, or formSideHtml arguments. The attack can be launched remotely, and the exploit has been publicly released. The vendor did not respond.
- CVE-2026-5467Medium
A vulnerability was identified in Casdoor 2.356.0 in the OAuth Authorization Request Handler. Manipulation of the redirect_uri argument leads to an open redirect. The attack can be performed remotely and the exploit is publicly available.
- CVE-2025-61524High
In Casdoor version 2.26.0 and earlier, a vulnerability in the permission verification module and organization/application editing interface allows remote authenticated administrators of any organization to bypass the system's permission verification mechanism by directly concatenating URLs after login. The issue is fixed in version 2.63.0.
- CVE-2023-34927Medium
Casdoor v1.331.0 and below was found to contain a Cross-Site Request Forgery (CSRF) vulnerability in the /api/set-password endpoint. This vulnerability allows attackers to arbitrarily change the victim user's password by supplying a crafted URL.
Original NVD description (English source)
Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password salts and email addresses, create administrator accounts, modify existing users, and delete them in any organization by supplying legitimate credentials from a single application.