Missing Authentication Vulnerability in Casdoor API Endpoint
CVE-2026-105307

6.9MEDIUM

Key Information:

Vendor

Casdoor

Status
Casdoor
Vendor
CVE Published:
5 October 2026

What is CVE-2026-105307?

A significant vulnerability has been identified in the Casdoor API Endpoint, specifically within the function ApiFilter located in the routers/authz_filter.go file. This issue allows for manipulation that results in missing authentication checks, making it possible for unauthorized users to execute actions remotely without proper validation. Given that the exploitation method is now publicly accessible, it poses an immediate risk to systems running affected versions. The vendor has been informed about this vulnerability but has not addressed the issue.

Affected Version(s)

Casdoor 3.161.0

Casdoor 3.161.1

References

https://vuldb.com/vuln/413512
vdb-entrytechnical-description
https://vuldb.com/vuln/413512/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105307
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Smallblack (VulDB User)
VulDB CNA Team
.