CVE-2026-84423

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-84423
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84423.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-84423
Published
2026-09-01T22:45:22.377Z
Modified
2026-09-04T03:31:05.865874927Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Casdoor upload-resource API resource.go missing authentication
Details

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84423.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-287",
        "CWE-306"
    ]
}
References

Affected packages

Git / github.com/casdoor/casdoor

Affected ranges

Type
GIT
Repo
https://github.com/casdoor/casdoor
Events
Introduced
9b8ddd5d6c46c1ca34da185e0e6bde9934f4b223
Last affected
9b8ddd5d6c46c1ca34da185e0e6bde9934f4b223
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "4.0"
        },
        {
            "last_affected": "4.0"
        }
    ]
}

Affected versions

4.*
4.0
v4.*
v4.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84423.json"