Casbin Casdoor
11 CVEs affecting Casbin Casdoor. Latest disclosed: 2026-05-11. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-38638 | Critical | 9.1 | 2022-09-09 | Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource. |
CVE-2024-41657 | High | 8.1 | 2024-08-20 | Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the… |
CVE-2022-44942 | High | 8.1 | 2022-12-07 | Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function. |
CVE-2024-41264 | High | 7.5 | 2024-08-01 | An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method. |
CVE-2022-24124 | High | 7.5 | 2022-01-29 | The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations. |
CVE-2023-34927 | Medium | 6.5 | 2023-06-22 | Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers… |
CVE-2024-41658 | Medium | 6.1 | 2024-08-20 | Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, he purchase URL that is created to… |
CVE-2026-6815 | Medium | 5.9 | 2026-05-11 | An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker… |
CVE-2026-5469 | Medium | 4.7 | 2026-04-03 | A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can l… |
CVE-2026-5467 | Medium | 4.3 | 2026-04-03 | A vulnerability was identified in Casdoor 2.356.0. Affected by this issue is some unknown functionality of the component OAuth Authorization Request Handler. S… |
CVE-2026-5468 | Low | 3.5 | 2026-04-03 | A security flaw has been discovered in Casdoor 2.356.0. This affects the function dangerouslySetInnerHTML. Performing a manipulation of the argument formCss/fo… |