Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-108572: Casdoor allows remote request forgery via proxy validation

CVE-2026-108572 · published 7 days ago

Summary

The Casdoor system (versions up to 3.164.0 and 4.10.0) can be tricked into sending internal network requests when a specially crafted URL is provided to its proxy validation feature. This could let an attacker make the server access unintended locations, potentially exposing data or services. Upgrade Casdoor to version 4.11.0 or later to resolve the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
–	casdoor	3.164

Original advisory text

Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery

A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 4.11.0 is able to address this issue. The name of the patch is 03c6c9aaa2eda5b085ce128ce0d60b34094efbd9/ada08ecd10cbf158f593dee23a8bab63efecf995. It is advisable to upgrade the affected component.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-1085... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-108572 Vendor Advisory
https://vuldb.com/cve/CVE-2026-108572 third-party-advisory
https://vuldb.com/vuln/416229 vdb-entry technical-description
https://vuldb.com/vuln/416229/cti signature permissions-required
https://vuldb.com/submit/954813 third-party-advisory
https://github.com/casdoor/casdoor/commit/03c6c9aaa2eda5b085ce128ce0d60b34094efb... patch
https://github.com/casdoor/casdoor/releases/tag/v4.11.0 patch
https://github.com/casdoor/casdoor/ product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

2.1 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published11 Oct 2026

Updated16 Oct 2026

First seen11 Oct 2026

Sources

CVE-2026-108572 · NVD

CVE-2026-108572 · OSV

CVE-2026-108572 · MITRE

Track software like this

Free during beta