CISA advises on Casdoor authorization bypass affecting versions 3.115.0

Casdoor versions 3.115.0 and earlier have an authorization bypass vulnerability that allows an authenticated organization administrator to perform unauthorized administrative actions against arbitrary organizations. In multi-tenant deployments, the issue can bypass tenant isolation and affect administrative operations across tenant boundaries.

The vulnerability is identified as CVE-2026-15630. It arises from a desynchronization between authorization and action in multiple POST endpoints under /api/{add,delete}, including /api/add-user, /api/delete-user, and /api/add-permission. The global authorization filter in routers/authzfilter.go uses the ?id= URL query parameter as the authoritative target for authorization decisions, but affected controllers such as controllers/user.go and controllers/permission.go ignore ?id= and instead operate on the owner and name fields in the JSON request body. This enables authorization to be evaluated for one object while the requested operation executes against another when the attacker has IsAdmin=true, permitting unauthorized administrative actions across tenant boundaries.

An attacker with administrative privileges in one organization can compromise the isolation guarantees of a multi-tenant Casdoor deployment. Depending on exposed endpoints and deployment configuration, successful exploitation can enable administrative operations for user management and privilege management, along with disruption of Security Assertion Markup Language (SAML) identity and single sign-on (SSO). The overall impact can escalate to a complete compromise of tenant isolation and, in some deployment scenarios, potential compromise of the entire Casdoor instance.

No vendor patch is known to be available at the time of publication. If upgrading to a fixed release is not possible, the guidance includes enforcing least privilege by minimizing accounts with IsAdmin=true and disabling workflows that automatically grant admin privilege. It also recommends requiring multi-factor authentication (MFA) for all administrative accounts and/or administrative actions, and alerting on cross-organization administrative activity, including creation of administrator accounts, deletion of users belonging to other organizations, and modification of permissions across organizational boundaries using wildcard resources=[“”] or actions=[“”] permissive Casbin rules. Additional guidance calls for investigating unexplained reductions in user counts or administrative objects within any organization.

The report credits Louis Sanchez of Voke Cyber for reporting the vulnerability and states that the document was written by Alexander Curtis.

Blog post, originally published by Alexander Curtis at kb.cert.org.