Casdoor IAM Cross-Tenant Authorization Bypass via ID/Body Desync (CVE-2026-15630)

The following is a summary of key vulnerability information from the web page screenshot: --- Vulnerability Overview CVE-2026-15630: Cross-Tenant Authorization Bypass in Casdoor IAM — Authorization vs. Action Mismatch Casdoor’s global authorization filter ( ) determines whether state-change requests are allowed based on the parameter in the URL. However, the affected controllers (such as , , etc.) completely ignore the parameter. Instead, they determine the target object solely from the and fields in the JSON request body, without performing any caller authorization checks. An attacker who is an organization administrator ( ) in any tenant can send a single request where the parameter points to a resource they own (passing authorization), while the JSON body points to a resource belonging to another tenant (executing the actual operation). This enables cross-tenant unauthorized actions, including deleting users, implanting backdoor administrators, wiping SSO certificates, or implanting global administrator permission rules. --- Impact Scope Product: Casdoor (Open-source Identity and Access Management Platform) Affected Versions: All versions up to v3.115.0 (current latest, released on 2026-07-12) Severity: Critical (CVSS v3.1 Base Score 9.6) CVSS Vector: Patch Status: No patch available as of publication Reporter: Louis Sanchez — Voke Cyber Coordinating Body: CERT/CC (VU#889462), Vendor Unresponsive --- Remediation / Temporary Mitigations 1. Minimize Organization Administrator Accounts Grant only to necessary personnel. Disable registration flows or workflows that automatically grant organization administrator status. Enable Multi-Factor Authentication (MFA) for all administrator accounts. 2. Optional: Add Reverse Proxy or WAF Rule Implement rules on and endpoints to reject requests where the in the request body does not match the URL parameter. Exception: Allow legitimate writes to other organizations by built-in global admin sessions. Run in log mode across the entire family (approximately 25 endpoints). Note: Rules covering only would leave the remaining 24 endpoints exposed. 3. Monitor for Attack Signatures Monitor for requests on endpoints where the parameter does not match the in the request body. Monitor for new Casbin rules appearing in built-in organizations (especially those containing resources/actions). Monitor for users creating/deleting users or administrators in another organization within their own. Monitor for unexplained sudden drops in tenant user counts. Correct Code-Level Fix Recommendation: Each affected controller should derive the target object from the authoritative identifier (URL ) and reject requests specifying a different object in the request body. This should mirror the pattern used by Casdoor in the path, with caller authorization checks attached at the object level as a defense-in-depth measure. --- POC Example Code The server returns and deletes — a user the attacker has no access to. --- Exploitation Chain Example (Requires Multiple Requests) 1. Clear Victim Tenant: Delete all users (including admins) to leave the tenant without an owner. 2. Implant Backdoor Administrator: Create a new user in the victim organization and set . 3. Escalate to Global Administrator: Implant a Casbin permission rule in the built-in global admin organization, granting full control over any resource/action. 4. Disrupt Federation: Delete the victim organization's signature certificate, causing SAML/OIDC Single Sign-On to fail. --- Disclosure Timeline 2026-05-13: Vulnerability discovered and reproduced; reported to CERT/CC and MITRE. 2026-05-28: Vendor patched nine unrelated Casdoor issues, but this vulnerability was not included. 2026-07-12: Re-verified; no fix present. Filter still relies on , and controllers still rely on the request body. 2026-07-20: CERT/CC assigned CVE-2026-15630, published VU#889462, and issued a public warning due to inability to contact the vendor. --- References CERT/CC Vulnerability Notice: VU#889462 CVE Record: CVE-2026-15630 Casdoor Project: casdoor.org • github.com/casdoor/casdoor Blog Post (Story and Disclosure Narrative): CVE-2026-15630: When the Authorization Check and the Action Look at Different Objects --- > Discovered and Reported by: Louis Sanchez, Founder and Principal Security Consultant at Voke Cyber (OSCP, OSWA, CISSP, CCSK). Previous advisories include CVE-2026-39878, CVE-2026-48742, CVE-2026-35188, CVE-2026-48507, CVE-2026-42318.

Goal Reached Thanks to every supporter — we hit 100%!

Casdoor IAM Cross-Tenant Authorization Bypass via ID/Body Desync (CVE-2026-15630)