CVE-2025-4210: Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-02 · updated 2026-06-17
Weakness: CWE-285

Description

A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.812.0 is able to address this issue. The name of the patch is 3d12ac8dc2282369296c3386815c00a06c6a92fe. It is recommended to upgrade the affected component.

Affected products

Casdoor: 1.811

References

https://github.com/casdoor/casdoor/commit/3d12ac8dc2282369296c3386815c00a06c6a92fe
https://github.com/casdoor/casdoor/releases/tag/v1.812.0
https://vuldb.com/?ctiid.307180
https://vuldb.com/?id.307180
https://vuldb.com/?submit.556201

Get alerted when CVE-2025-4210 or the next vulnerability affects your stack