Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-91998: Casdoor allows cross-organization user admin with app credentials

CVE-2026-91998 · published 17 days ago

Summary

Casdoor versions up to 4.4.0 let anyone who knows a client ID and secret for any Casdoor application manage users in every organization. With those credentials an attacker can view user details, create admin accounts, change or delete users across all tenants. Apply the latest Casdoor update or restrict access to the /api/mcp endpoint to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
casdoor	casdoor	<= 4.4.0

Original advisory text

Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp

Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password salts and email addresses, create administrator accounts, modify existing users, and delete them in any organization by supplying legitimate credentials from a single application.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91998... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-91998 Vendor Advisory
https://github.com/geo-chen/oss/blob/main/casdoor.md#finding-2-application-crede... Exploit
https://github.com/casdoor/casdoor/blob/v4.4.0/authz/authz.go#L174-L176 Third Party Advisory
https://github.com/casdoor/casdoor/blob/v4.4.0/routers/base.go#L122-L154 Third Party Advisory
https://github.com/casdoor/casdoor/blob/v4.4.0/mcpself/user.go Third Party Advisory
https://github.com/casdoor/casdoor Product
https://www.vulncheck.com/advisories/casdoor-through-4.4.0-cross-organization-us... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.4 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-863Incorrect Authorization

Timeline

Published15 Sep 2026

Updated1 Oct 2026

First seen15 Sep 2026

Sources

CVE-2026-91998 · NVD

CVE-2026-91998 · MITRE

CVE-2026-91998 · OSV

Track software like this

Free during beta