Cross-Tenant Authorization Flaw in Casdoor by Xuanmeng Tech
CVE-2026-15630

9.9CRITICAL

Key Information:

Vendor

Casdoor

Status
Casdoor
Vendor
CVE Published:
23 July 2026

What is CVE-2026-15630?

A vulnerability in Casdoor allows a non-global organization admin within one tenant to bypass tenant boundaries. This exploitation occurs due to inconsistencies between the authorization checks (based on the request ID) and the actions permitted (determined by the request body). As a result, attackers can delete, create, or modify resources in other tenants, posing significant security risks to data isolation and management.

Affected Version(s)

Casdoor 0

References

https://vokecyber.com/research/cve-2026-15630-casdoor-cro...

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.