What’s Vulnerable › Vulnerabilities

CVE-2025-61524

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-08 · updated 2026-07-05
• Weakness: CWE-285

Description

An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remote authenticated administrators of any organization within the system to bypass the system's permission verification mechanism by directly concatenating URLs after login

References

• https://gist.github.com/DevHjz/e75cea851d48e5f5478ac2a90757851a
• https://github.com/casdoor/casdoor/commit/d883db907bb6e0b95737ef8e8b57b7da9078cbdd
• https://github.com/casdoor/casdoor/releases/tag/v2.63.0
• https://gist.github.com/DevHjz/e75cea851d48e5f5478ac2a90757851a

Get alerted when CVE-2025-61524 or the next vulnerability affects your stack