CVE-2026-91998: Casdoor Authorization Bypass Vulnerability

CVE-2026-91998 Overview

Casdoor through version 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint. The flaw allows any actor holding a valid clientId and clientSecret from a single registered application to perform user administration operations across all organizations managed by the Casdoor instance. Attackers can enumerate user records, harvest password salts and email addresses, create administrator accounts, modify existing users, and delete accounts in any organization. The weakness is classified under CWE-863: Incorrect Authorization and affects the multi-tenant boundary that Casdoor is designed to enforce.

Critical Impact
A single low-privilege application credential grants full cross-organization user administration, enabling tenant compromise, privilege escalation, and account takeover.

Affected Products

Casdoor identity and access management platform
All Casdoor releases up to and including version 4.4.0
Deployments exposing the /api/mcp endpoint to any authenticated application

Discovery Timeline

2026-09-15 - CVE-2026-91998 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91998

Vulnerability Analysis

Casdoor exposes a Model Context Protocol (MCP) interface at /api/mcp intended to support user administration workflows. The endpoint accepts standard application credentials (clientId and clientSecret) issued to any registered application in the platform. Once those credentials pass authentication, the request handler in mcpself/user.go proceeds to service user management operations without enforcing tenant scoping or role-based authorization. As a result, application credentials issued for a narrow purpose in one organization become universal administration tokens across the entire Casdoor deployment.

The impact set covers user enumeration, retrieval of password salts, creation of new administrator accounts, modification of existing users, and account deletion. Because the endpoint accepts any application's credentials, an attacker who compromises even a low-trust integration inherits full write access to identity data belonging to unrelated tenants.

Root Cause

The authorization logic implemented in authz/authz.go (see lines 174-176 in the v4.4.0 tree) short-circuits access checks when the request path matches the MCP route. The base router in routers/base.go (lines 122-154) similarly bypasses the ownership and organization filters that other administrative endpoints enforce. Authentication is conflated with authorization: possession of any valid application secret is treated as sufficient proof to act on any user resource. See the VulnCheck advisory and the independent credential bypass analysis for the code path walkthrough.

Attack Vector

Exploitation is remote and requires only network reachability to the Casdoor /api/mcp endpoint plus one legitimate clientId/clientSecret pair. An attacker authenticates to the MCP endpoint, then issues MCP tool calls that map to user administration verbs. Requests targeting arbitrary organization identifiers succeed because the handler does not compare the requester's application scope to the target organization. See the Casdoor repository for endpoint definitions and the user management source for the vulnerable handlers.

No public exploit code has been catalogued in ExploitDB, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-91998

Indicators of Compromise

Requests to /api/mcp originating from application credentials that historically only interacted with self-service endpoints.
MCP tool invocations referencing owner or organization values other than the calling application's registered organization.
Unexpected creation of accounts with the isAdmin or isGlobalAdmin flag set to true.
Bulk user read operations returning password_salt or email fields to non-administrative applications.

Detection Strategies

Enable verbose access logging for /api/mcp and alert on any request whose target organization differs from the calling application's organization.
Correlate application credential usage against a baseline of expected endpoints; MCP administrative calls from previously read-only integrations are high-signal anomalies.
Review audit trails for administrator role assignments and user deletions that lack a corresponding human operator session.

Monitoring Recommendations

Forward Casdoor application and audit logs to a centralized analytics platform for retention and cross-source correlation.
Track counts of user records read per application credential per hour and alert on deviations from historical baselines.
Monitor egress from Casdoor hosts for unusual outbound transfer volumes that may indicate credential or salt exfiltration.

How to Mitigate CVE-2026-91998

Immediate Actions Required

Restrict network access to the /api/mcp endpoint using a reverse proxy or web application firewall until a patched release is deployed.
Rotate every clientSecret issued by the Casdoor instance and audit which applications currently hold credentials.
Review administrator and global administrator account rosters in every organization and remove any accounts that cannot be traced to a legitimate provisioning event.
Force password resets for user accounts whose salts may have been exposed through MCP enumeration.

Patch Information

No fixed version is identified in the NVD record at publication. Casdoor operators should track the Casdoor GitHub repository for a release beyond 4.4.0 that enforces organization-scoped authorization in authz/authz.go and routers/base.go. Refer to the VulnCheck advisory for updates on the vendor fix.

Workarounds

Block or reverse-proxy-deny all requests to /api/mcp at the network edge until authorization is corrected upstream.
Restrict issuance of application credentials to trusted, tightly scoped integrations and disable unused applications in the Casdoor console.
Segment the Casdoor deployment so that its administrative API is reachable only from an internal management network.

bash

# Example NGINX snippet to deny external access to the MCP endpoint
location /api/mcp {
    deny all;
    return 403;
}