VU#889462: Casdoor authentication server is vulnerable to authorization bypass
Brief
Overview
Casdoor is an open-source Access Management (IAM) platform used to manage web applications. An authorization bypass vulnerability affects Casdoor versions 3.
- 0 and earlier.
The vulnerability allows a non-global organization administrator to perform unauthorized administrative actions against arbitrary organizations by exploiting inconsistent object resolution between the authorization layer and downstream controllers.
In multi-tenant deployments, an attacker with administrative privileges within a single organization can bypass tenant isolation and perform administrative operations against other organizations. Description CVE-2026-15630. POST /api/{add,delete}- endpoints (e. g. , /api/add-user, /api/delete-user, /api/add-permission). While the global authorization filter (routers/authzfilter. go) correctly uses the ?