GHSA-5m9m-j5p7-m7f9

Source

https://github.com/advisories/GHSA-5m9m-j5p7-m7f9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-5m9m-j5p7-m7f9/GHSA-5m9m-j5p7-m7f9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5m9m-j5p7-m7f9

Aliases

Published

2025-10-08T21:30:34Z

Modified

2025-11-05T19:57:10.988637Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Casdoor is vulnerable to Improper Authorization

Details

An issue in the permission verification module and organization/application editing interface in Casdoor before 2.63.0 allows remote authenticated administrators of any organization within the system to bypass the system's permission verification mechanism by directly concatenating URLs after login.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-14T20:12:38Z",
    "severity": "HIGH",
    "nvd_published_at": "2025-10-08T19:15:44Z",
    "cwe_ids": [
        "CWE-285"
    ]
}

References

Affected packages

Go / github.com/casdoor/casdoor

Package

Name: github.com/casdoor/casdoor; View open source insights on deps.dev
Purl: pkg:golang/github.com/casdoor/casdoor

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.63.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-5m9m-j5p7-m7f9/GHSA-5m9m-j5p7-m7f9.json"