CVE-2026-84423: Casdoor Authentication Bypass Vulnerability

CVE-2026-84423 Overview

CVE-2026-84423 is a missing authentication vulnerability in Casdoor identity and access management platform versions up to 4.0.0. The flaw resides in the upload-resource API endpoint implemented in controllers/resource.go. Attackers can invoke this endpoint remotely without providing credentials, enabling unauthenticated arbitrary file uploads to the server.

The vulnerability has been publicly disclosed and technical details are available. According to the disclosure, the vendor deleted the associated GitHub issue and did not respond to follow-up communication. The weakness is classified under CWE-287: Improper Authentication.

Critical Impact
Unauthenticated remote attackers can upload arbitrary files to a Casdoor deployment, potentially staging content for follow-on attacks against users or downstream services.

Affected Products

Casdoor versions up to and including 4.0.0
Component: upload-resource API
File: controllers/resource.go

Discovery Timeline

2026-09-01 - CVE-2026-84423 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84423

Vulnerability Analysis

Casdoor exposes an upload-resource API used to store files such as user avatars and application assets. The handler in controllers/resource.go fails to enforce authentication before processing incoming upload requests. As a result, any remote client that can reach the Casdoor HTTP interface can submit an upload without presenting session cookies, API tokens, or other credentials.

The attack surface is network-reachable and requires no user interaction. Because Casdoor typically serves as a centralized identity provider, exposed instances are frequently accessible from untrusted networks. This amplifies the practical reach of the flaw across single sign-on deployments.

Root Cause

The root cause is missing authentication enforcement on a sensitive administrative endpoint [CWE-287]. Access control checks that gate other resource-management functions are not applied to the upload path. The handler proceeds to write attacker-supplied content into storage governed by Casdoor.

Attack Vector

Exploitation requires only network access to the vulnerable Casdoor instance. An attacker sends a crafted HTTP request to the upload-resource endpoint with a file payload. No authentication tokens, prior privileges, or user interaction are required to complete the request.

The uploaded content can be used to host phishing pages, serve malicious payloads under the trust of the identity provider's domain, or fill storage as a low-effort denial-of-service technique. Additional impact depends on how downstream applications consume Casdoor-hosted resources. Refer to the Casdoor vulnerability report by geo-chen for reproduction details.

Detection Methods for CVE-2026-84423

Indicators of Compromise

Unauthenticated HTTP POST requests to /api/upload-resource originating from unexpected source IP addresses.
New or unfamiliar files appearing in the Casdoor resource storage backend without a corresponding administrator action in audit logs.
Requests to upload-resource that lack an authenticated user identifier in access logs.

Detection Strategies

Correlate web server access logs with Casdoor application audit logs to flag upload-resource calls without an associated authenticated session.
Alert on file uploads with executable, HTML, or script MIME types delivered to the Casdoor resource path.
Monitor for anomalous spikes in POST traffic to /api/upload-resource from a single source or across many sources.

Monitoring Recommendations

Forward Casdoor reverse-proxy and application logs to a centralized SIEM or data lake for retention and correlation.
Inventory public-facing Casdoor deployments and verify version numbers against the fixed release.
Track outbound links to files hosted on Casdoor resource paths to identify potential phishing reuse.

How to Mitigate CVE-2026-84423

Immediate Actions Required

Identify Casdoor deployments running version 4.0.0 or earlier and restrict access to trusted networks until a patched release is deployed.
Place the Casdoor instance behind an authenticating reverse proxy or web application firewall that enforces authentication on /api/upload-resource.
Review resource storage for unexpected uploads created since the deployment date and remove attacker-supplied content.

Patch Information

No vendor-supplied fix is referenced in the CVE record at the time of publication. According to the disclosure, the vendor deleted the GitHub tracking issue and did not respond to disclosure emails. Monitor the Casdoor GitHub repository for updated releases and the VulDB entry for CVE-2026-84423 for advisory changes.

Workarounds

Block or authenticate requests to the upload-resource endpoint at the reverse proxy layer using access control lists.
Restrict Casdoor administrative APIs to internal network segments and VPN-authenticated users.
Enforce strict MIME type and file extension allow-lists on any component that fronts Casdoor uploads.

bash

# Example NGINX configuration to require authentication on upload-resource
location = /api/upload-resource {
    auth_request /_auth_check;
    proxy_pass http://casdoor_backend;
}

location = /_auth_check {
    internal;
    proxy_pass http://auth_service/validate;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
}