Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.
Summary
A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.812.0 is able to address this issue. The name of the patch is 3d12ac8dc2282369296c3386815c00a06c6a92fe. It is recommended to upgrade the affected component.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Casdoor | 1.811 | — | No fix listed | CNA |
| — | github.com/casdoor/casdoor (Go) | before 1.812.0 | 1.812.0 | Patch available | GHSA-8w8f-h4cm-c4pg |
- Casdoor Vendor— Affected 1.811 Fixed in — No fix listed CNA
- github.com/casdoor/casdoor (Go) Vendor— Affected before 1.812.0 Fixed in 1.812.0 Patch available GHSA-8w8f-h4cm-c4pg
Remediation
- Fix · GHSA-8w8f-h4cm-c4pg github.com/casdoor/casdoor (Go) Fixed in 1.812.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-4210
- 2026-10-03 Alias added: GHSA-8w8f-h4cm-c4pg
References
Sources
- CVE-2025-4210 · CVE Program
- CVE-2025-4210 · NVD
- FIRST EPSS
- GHSA-8w8f-h4cm-c4pg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences