CVE-2026-91998

Casdoor through version 4.4.0 contains an authorization bypass (CWE-863) in its /api/mcp endpoint, rated critical at CVSS 4.0 9.4. An attacker who possesses the clientId and clientSecret of any single application registered in a Casdoor deployment can use those otherwise low-privilege credentials to perform unrestricted user administration across all organizations, including enumerating user records with password salts and email addresses, creating administrator accounts, and modifying or deleting users in any organization. The flaw effectively breaks tenant isolation, turning per-application credentials into full platform-wide user management control. Any organization self-hosting Casdoor at or below version 4.4.0 with the /api/mcp endpoint reachable is affected. No public proof-of-concept is known and there is no evidence of in-the-wild exploitation, but the only prerequisite is a leaked or brute-forced client secret, so exposure of those secrets materially raises risk.

What to do: Upgrade Casdoor beyond 4.4.0 as soon as a patched release is available, as no fixed version is specified in the current advisory. In the meantime, restrict network access to the /api/mcp endpoint (or the whole admin/API surface) to trusted sources, rotate all application clientId/clientSecret pairs since any single compromised pair enables the attack, and audit logs and user lists for unexpected administrator accounts, new users, or modifications/deletions across organizations.