VU#889462: Casdoor authentication server is vulnerable to authorization bypass
Casdoor IAM versions 3.115.0 and earlier allow organization admins to bypass tenant isolation through inconsistent authorization checks, tracked as CVE-2026-15630.
CERT/CC published VU#889462 describing an authorization bypass in Casdoor, an open-source access management platform, affecting versions 3.115.0 and earlier. The flaw (CVE-2026-15630) stems from controllers ignoring the ?id= query parameter used for authorization decisions and acting on JSON body fields instead, letting a single-organization administrator perform unauthorized administrative actions against arbitrary organizations in multi-tenant deployments. Impact can escalate to complete tenant-isolation compromise and potential compromise of the entire Casdoor instance, including SSO/SAML disruption. No vendor patch is available because researchers could not reach Casdoor; mitigations include least privilege, MFA for admin accounts, and alerting on cross-organization administrative activity.
- Authorization evaluated on ?id= parameter while controllers act on JSON body owner/name fields
- Affects POST /api/add-user, /api/delete-user, /api/add-permission and similar endpoints
- Bypass enables user management, privilege changes, and SSO/SAML disruption across tenants
- No vendor patch available; mitigations include least privilege, MFA, and cross-org alerting
- CVEs
- CVE-2026-15630
- Products
- Casdoor
- Organizations
- Voke Cyber
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-15630 | A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch… | 9.9 | <1% |
From the original article
2 min read at kb.cert.orgOverview Casdoor is an open-source Access Management (IAM) platform used to manage web applications. An authorization bypass vulnerability affects Casdoor versions 3. 115.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.