Vulnerabilities

Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration acro…

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it.

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on re…

In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued b…

Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active.

Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds.

Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection.

Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange.

In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions.

Casdoor versions 2.362.0 and earlier contain a vulnerability involving unverified email binding that may enable account takeover.

Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements.

Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate.

An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider.

A weakness has been identified in Casdoor 2.356.0.

A security flaw has been discovered in Casdoor 2.356.0.

A vulnerability was identified in Casdoor 2.356.0.

Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform.

Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform.

An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.

Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password.

Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.

The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.