Skip to content
OpenAdvisories

Package · Go

github.com/casdoor/casdoor

20 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-9096

    CVE-2026-9096

    Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse() never reads thi…

    Casdoor Casdoor github.com/casdoor/casdoor Go
  • High 7.2
    CVE-2025-61524

    Casdoor is vulnerable to Improper Authorization

    An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remote authenticated administrators of any organization within the system to bypass the system's permiss…

    github.com/casdoor/casdoor Go
  • High 7.3
    CVE-2025-4210 Scanner template

    Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization

    A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The att…

    github.com/casdoor/casdoor Go
  • High 8.1
    CVE-2024-41657

    GHSL-2024-035: Casdoor CORS misconfiguration

    Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the log…

    Casdoor Casdoor github.com/casdoor/casdoor Go
  • High 7.5
    CVE-2024-41264

    casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification

    An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.

    github.com/casdoor/casdoor Go
  • High 8.1
    CVE-2022-44942

    Casdoor arbitrary file deletion vulnerability via uploadFile function

    Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.

    github.com/casdoor/casdoor Go
  • High 7.5
    CVE-2022-24124 Public exploit Scanner template EPSS 55%

    SQL Injection in Casdoor

    The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.

    github.com/casdoor/casdoor casdoor PyPI Go