Overview

Casdoor is an open-source Access Management (IAM) platform used to manage web applications. An authorization bypass vulnerability affects Casdoor versions 3.115.0 and earlier. The vulnerability allows a non-global organization administrator to perform unauthorized administrative actions against arbitrary organizations by exploiting inconsistent object resolution between the authorization layer and downstream controllers. In multi-tenant deployments, an attacker with administrative privileges within a single organization can bypass tenant isolation and perform administrative operations against other organizations.

Description

CVE-2026-15630.
The vulnerability stems from a desynchronization between authorization and action in multiple POST /api/{add,delete}- endpoints (e.g., /api/add-user, /api/delete-user, /api/add-permission). While the global authorization filter (routers/authzfilter.go) correctly uses the ?id= URL query parameter as the authoritative target for authorization decisions, the affected controllers (controllers/user.go, controllers/permission.go, etc.) ignore ?id= and operate solely on the owner and name fields in the JSON request body. As a result, authorization is evaluated against one object while the requested operation is executed against another, allowing an authenticated organization administrator (IsAdmin=true) to perform unauthorized administrative actions across tenant boundaries.

Impact

An attacker with administrative privileges in a single organization can compromise the isolation guarantees of a multi-tenant Casdoor deployment. Depending on the exposed endpoints and deployment configuration, successful exploitation can allow for administrative operations including user management, privilege management and disruption of single sign-on (SSO) or Security Assertion Markup Language (SAML) identity. The overall impact can escalate to a complete compromise of tenant isolation and, in some deployment scenarios, potential compromise of the entire Casdoor instance.

Solution

Unfortunately, we were unable to reach Casdoor to coordinate this vulnerability. Therefore, at the time of this publication, no vendor patch is known to be available. If upgrading to a fixed release is not yet possible, organizations can consider the following mitigations:

• Enforce least privilege by minimizing the number of accounts with IsAdmin=true, disabling any workflows that automatically grant admin privilege
• Require multi-factor authentication (MFA) for all administrative accounts and/or administrative actions
• Alert on cross-organization administrative activity, including:
  • Creation of administrator accounts
  • Deletion of users belonging to other organizations
  • Modification of permissions across organizational boundaries using wildcard resources=[""] or actions=[""] permissive Casbin rules.
• Investigate unexplained reductions in user counts or administrative objects within any organization.

Acknowledgements

Thank you to Louis Sanchez of Voke Cyber for reporting this vulnerability. This document was written by Alexander Curtis.

Vendor Information