Casdoor Has a CVSS 9.9 Cross-Tenant Bypass. One Admin Can Cross the Wall

• The Mess: Casdoor checks authorization against one object and then performs the requested action against another. A tenant administrator can cross organizational boundaries and manipulate resources belonging to other tenants.
• The Damage: CVE-2026-15630 can break tenant isolation, alter users and permissions, disrupt SSO or SAML identities, and potentially compromise the entire Casdoor instance.
• The Fix: Upgrade to a vendor-confirmed fixed release when available, reduce IsAdmin=true accounts immediately, enforce MFA and monitor cross-tenant administrative activity.

Multi-tenant IAM systems have one job that matters more than almost everything else:

Keep tenants apart.

Casdoor failed at exactly that.

CVE-2026-15630 is a critical authorization bypass affecting Casdoor versions 3.115.0 and earlier. The vulnerability lets an administrator belonging to one organization perform unauthorized administrative operations against another organization. CERT/CC rates the issue at CVSS 9.9 through CISA’s current vulnerability enrichment.

And the implementation mistake is unusually clean.

The authorization check works.

The operation works.

They just don’t agree about what they are operating on.

The Check Looks Fine

Casdoor’s authorization layer uses the ?id= parameter from the URL to determine which object the administrator is attempting to modify.

That sounds reasonable.

The affected controllers do something different.

They ignore that ?id= value and instead determine the target from fields supplied inside the JSON request body, such as owner and name.

So the application effectively performs this sequence:

Authorization:
“Is this administrator allowed to modify object A?”

Action:
“Okay, modify object B.”

That is the entire bug.

The security check isn’t absent.

It is checking the wrong thing.

Cross-Tenant Access Is the Result

Imagine a Casdoor deployment serving several organizations.

An administrator belongs to Tenant A.

The administrator legitimately has management rights over Tenant A’s users and permissions.

They should have no authority over Tenant B.

With CVE-2026-15630, the attacker can construct requests where the authorization layer evaluates one target while the downstream controller acts on another.

The result is a cross-tenant authorization bypass.

Affected operations include endpoints such as:

/api/add-user

/api/delete-user

/api/add-permission

and other add/delete controller paths.

The flaw isn’t tied to one isolated administrative function.

It sits in the mismatch between the authorization mechanism and the object-resolution logic.

Why IAM Makes This Ugly

Casdoor isn’t a random web application.

It is an identity and access management platform.

That means its database can contain the things other applications trust:

• user accounts;
• organization membership;
• permissions;
• SSO configuration;
• federation settings;
• SAML-related identity data.

Breaking tenant isolation therefore does more than expose somebody else’s application data.

It attacks the identity layer sitting underneath those applications.

CERT/CC warns that exploitation can allow unauthorized user management, privilege changes and disruption of SSO or SAML identity. In some deployments, the impact can reach the entire Casdoor instance.

The Dangerous Part Is the Privilege Level

This isn’t an unauthenticated Internet RCE.

The attacker needs an authenticated organization administrator account.

That distinction matters.

It also doesn’t save a poorly configured deployment.

A compromised tenant administrator account is enough to cross the boundary.

And that creates a particularly nasty attack chain:

phishing → tenant admin account → Casdoor → other tenants

The attacker doesn’t need to compromise the global administrator directly.

They can start with a lower-level administrative identity and use the authorization flaw to move sideways.

The Code Has Two Sources of Truth

Voke Cyber’s research describes the underlying design failure clearly: the authorization layer and the action layer use different sources to identify the target object.

That’s a classic authorization design trap.

One component says:

this request is about object A.

Another component says:

the request body says object B.

Both components believe they are doing their jobs.

Together, they create the vulnerability.

Authorization decisions should be tied to the exact object eventually modified.

Not to a value that another layer may interpret differently.

No Vendor Patch Was Known

CERT/CC says it attempted coordinated disclosure with Casdoor but did not receive a vendor statement.

At the time of the vulnerability note, no vendor patch was known to be available.

That changes the response for administrators.

CERT/CC recommends reducing the number of accounts with IsAdmin=true, disabling workflows that automatically grant administrator privileges and requiring MFA for administrative accounts or actions. It also recommends monitoring for suspicious cross-organization changes.

Those aren’t substitutes for a patch.

They’re damage control.

Hunt for Cross-Tenant Activity

Security teams running Casdoor should look for administrative actions that don’t make sense within the administrator’s normal organization.

Pay particular attention to:

• creation of administrators in another organization;
• deletion of users belonging to another tenant;
• unexpected permission changes;
• wildcard Casbin rules;
• modifications to SSO configuration;
• changes to SAML identity settings;
• unusual bursts of administrative API requests.

A compromised administrator account may not immediately generate an obvious malware alert.

The evidence can be entirely inside the application’s own audit trail.

Bugstoday Opinion

This is the kind of authorization bug that deserves more attention than its exploit mechanics initially suggest.

There is no spectacular memory corruption.

No kernel exploit.

No clever ROP chain.

The application simply asks one security question and then performs a different operation.

In a single-tenant application, that can be bad.

In an IAM platform built to separate organizations, it can tear down the wall between every tenant.

CVE-2026-15630 currently carries CVSS 9.9, has public PoC status in CISA’s enrichment data and affects Casdoor 3.115.0 and earlier.

If Casdoor is sitting underneath multiple applications, treat this as an identity infrastructure problem, not just another web vulnerability.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources

CERT/CC — VU#889462
CVE.org / MITRE — CVE-2026-15630
CISA Vulnerability Enrichment — CVE-2026-15630
Voke Cyber — CVE-2026-15630 Casdoor Cross-Tenant Authorization
Casdoor — Official Project