Cross-Tenant Authorization Flaw in Casdoor by Xuanmeng Tech

CVE-2026-15630

What is CVE-2026-15630?

A vulnerability in Casdoor allows a non-global organization admin within one tenant to bypass tenant boundaries. This exploitation occurs due to inconsistencies between the authorization checks (based on the request ID) and the actions permitted (determined by the request body). As a result, attackers can delete, create, or modify resources in other tenants, posing significant security risks to data isolation and management.

References