Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Casdoor — Vulnerabilities & Security Advisories 23

All 23 CVE vulnerabilities found in Casdoor, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with the open-source identity and access management platform Casdoor, specifically focusing on software weaknesses within its authentication and authorization components. The collection compiles reported security flaws, including injection attacks, broken access control, and cryptographic failures, covering disclosures from the product's initial release through recent updates. Readers can utilize this resource to track vendor advisories, understand the prevalence of specific weakness classes in identity providers, and review the historical vulnerability landscape for Casdoor deployments. By centralizing these records, the page facilitates risk assessment and security monitoring without requiring navigation across disparate databases.

Vendor: n/a

CVE ID Title CVSS Severity Published
CVE-2026-108572 Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery CWE-918 4.3 Medium 2026-10-11
CVE-2026-105307 Casdoor API Endpoint authz_filter.go ApiFilter missing authentication CWE-306 7.3 High 2026-10-05
CVE-2026-91998 Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp CWE-863 9.9 Critical 2026-09-15
CVE-2026-90942 Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints CWE-863 9.6 Critical 2026-09-14
CVE-2026-84423 Casdoor upload-resource API resource.go missing authentication CWE-306 7.3 High 2026-09-01
CVE-2026-15630 CVE-2026-15630 - - 2026-07-23
CVE-2026-9098 CVE-2026-9098 - - 2026-05-28
CVE-2026-9097 CVE-2026-9097 - - 2026-05-28
CVE-2026-9096 CVE-2026-9096 - - 2026-05-28
CVE-2026-9095 CVE-2026-9095 - - 2026-05-28
CVE-2026-9094 CVE-2026-9094 - - 2026-05-28
CVE-2026-9093 CVE-2026-9093 - - 2026-05-28
CVE-2026-9092 CVE-2026-9092 - - 2026-05-28
CVE-2026-9091 CVE-2026-9091 - - 2026-05-28
CVE-2026-9090 CVE-2026-9090 - - 2026-05-28
CVE-2026-6815 CVE-2026-6815 - - 2026-05-11
CVE-2026-5469 Casdoor Webhook URL server-side request forgery CWE-918 4.7 Medium 2026-04-03
CVE-2026-5468 Casdoor dangerouslySetInnerHTML cross site scripting CWE-79 3.5 Low 2026-04-03
CVE-2026-5467 Casdoor OAuth Authorization Request redirect CWE-601 4.3 Medium 2026-04-03
CVE-2025-4210 Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization CWE-639 7.3 High 2025-05-02
CVE-2024-41658 GHSL-2024-036: Reflected XSS in QrCodePage.js CWE-79 6.1 Medium 2024-08-20
CVE-2024-41657 GHSL-2024-035: Casdoor CORS misconfiguration CWE-942 8.1 High 2024-08-20
CVE-2024-5587 Casdoor Configuration File app.conf file access CWE-552 5.3 Medium 2024-06-02

All 23 known CVE vulnerabilities affecting Casdoor with full Chinese analysis, references, and POCs where available.