Advisories · Technology
Casdoor.
Every CVE that names Casdoor among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery
- Casdoor
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Casdoor API Endpoint authz_filter.go ApiFilter missing authentication
- Casdoor
- Authentication bypass
- CVSS 9.4 CriticalCritical · CVSS 9+
Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp
- casdoor
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints
- casdoor
- Broken access control
- CVSS 6.9 Medium
Casdoor upload-resource API resource.go missing authentication
- Casdoor
- Authentication bypass
- CVSS 9.9 CriticalCritical · CVSS 9+
CVE-2026-15630
- Casdoor
- Privilege escalation
- Broken access control
- CVSS 8.1 High
CVE-2026-9095
- Casdoor
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
CVE-2026-9092
- Casdoor
- CVSS 6.9 Medium
Casdoor Configuration File app.conf file access
- Casdoor
- Information disclosure