What’s Vulnerable › Products

Casdoor vulnerabilities

28 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.

Check whether your Casdoor version is affected

Latest Casdoor vulnerabilities

• CVE-2026-108572 — Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery (CVSS 4.3)
• CVE-2026-105307 — Casdoor API Endpoint authz_filter.go ApiFilter missing authentication (CVSS 7.3)
• CVE-2026-91998 — Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp (CVSS 9.9)
• CVE-2026-90942 — Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints (CVSS 9.6)
• CVE-2026-84423 — Casdoor upload-resource API resource.go missing authentication (CVSS 7.3)
• CVE-2026-15630 — CVE-2026-15630 (CVSS 9.9)
• CVE-2026-9098 — CVE-2026-9098 (CVSS 9.1)
• CVE-2026-9097 — CVE-2026-9097 (CVSS 9.8)
• CVE-2026-9096 — CVE-2026-9096 (CVSS 7.5)
• CVE-2026-9095 — CVE-2026-9095 (CVSS 8.1)
• CVE-2026-9094 — CVE-2026-9094 (CVSS 9.8)
• CVE-2026-9093 — CVE-2026-9093 (CVSS 9.8)
• CVE-2026-9092 — CVE-2026-9092 (CVSS 9.1)
• CVE-2026-9091 — CVE-2026-9091 (CVSS 5.3)
• CVE-2026-9090 — CVE-2026-9090 (CVSS 9.1)
• CVE-2026-6815 — CVE-2026-6815 (CVSS 5.9)
• CVE-2026-5469 — Casdoor Webhook URL server-side request forgery (CVSS 7.2)
• CVE-2026-5468 — Casdoor dangerouslySetInnerHTML cross site scripting (CVSS 5.4)
• CVE-2026-5467 — Casdoor OAuth Authorization Request redirect (CVSS 6.1)
• CVE-2025-4210 — Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization (CVSS 7.3)
• CVE-2024-41658 — GHSL-2024-036: Reflected XSS in QrCodePage.js (CVSS 6.1)
• CVE-2024-41657 — GHSL-2024-035: Casdoor CORS misconfiguration (CVSS 8.8)
• CVE-2024-41264 — (CVSS 7.5)
• CVE-2024-5587 — Casdoor Configuration File app.conf file access (CVSS 5.3)
• CVE-2023-34927 — (CVSS 6.5)