CVE-2026-91998 in Casdoor
Summary
by MITRE • 09/15/2026
Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password salts and email addresses, create administrator accounts, modify existing users, and delete them in any organization by supplying legitimate credentials from a single application.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Casdoor versions up to 4.4.0 represents a critical failure in access control logic within the Multi-Cloud Permission (MCP) API endpoint. This flaw stems from an insufficient verification of organizational boundaries during authentication and authorization processes. Specifically, the system fails to validate that the application credentials used for authentication are explicitly scoped or permitted to operate within the target organization's context. Consequently, any valid clientId and clientSecret pair obtained from a single Casdoor instance can be leveraged to bypass administrative restrictions across all organizations hosted on that same deployment. This architectural oversight effectively neutralizes multi-tenancy isolation, allowing lateral movement between distinct organizational units without requiring additional credentials or privilege escalation exploits beyond the initial acquisition of basic application secrets.
From a technical perspective, this issue is classified under CWE-284 Improper Access Control and aligns with MITRE ATT&CK technique T1078 Valid Accounts, as it involves the misuse of legitimate authentication materials to gain unauthorized access. The root cause lies in the API handler for /api/mcp not enforcing strict tenant isolation checks when processing requests that involve user management operations. When an attacker supplies credentials from one application, the backend logic incorrectly assumes these credentials grant broad administrative privileges across the entire system rather than restricting them to the specific organization associated with those credentials. This lack of context-aware authorization allows the API endpoint to execute high-privilege actions such as creating new administrator accounts, modifying existing user attributes, and deleting users in organizations where the attacker has no legitimate standing or permission.
The operational impact of this vulnerability is severe due to its potential for complete system compromise and data exfiltration. Attackers can enumerate sensitive user records across all organizations, including password salts and email addresses, which facilitates offline cracking attacks against hashed passwords if those hashes are also exposed. Furthermore, the ability to create administrator accounts grants persistent backdoor access that persists even after initial detection or remediation attempts unless specifically audited. The capability to modify existing users allows attackers to alter permissions, lock out legitimate administrators, or change contact information for account recovery abuse. Deletion of user records can lead to denial of service conditions and loss of critical audit trails, complicating forensic investigations and compliance reporting requirements such as GDPR or HIPAA if personal data is destroyed without authorization.
Mitigation strategies must focus on immediate patching and enhanced access control enforcement. Organizations running Casdoor versions prior to 4.4.0 should upgrade to the latest patched version where this logic error has been corrected by implementing strict tenant-scoped validation for all administrative API endpoints. In addition to upgrading, administrators should audit existing application registrations to ensure that client secrets are rotated regularly and stored securely using vaulted solutions rather than hardcoded configurations. Implementing additional network-level controls such as IP whitelisting for sensitive admin APIs can provide defense-in-depth measures while the upgrade is being deployed. Security teams should also monitor logs for unusual patterns of user enumeration or administrative changes originating from unexpected application identities, which may indicate exploitation attempts against this vulnerability before patches are applied.