Suse
CVE-2025-61524
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 05, 2026
Improper authorization in Casdoor (an open-source Identity and Access Management / SSO platform) versions 2.26.0 and earlier lets a remote authenticated administrator of ANY organization escalate beyond their tenant boundary. Because the permission-verification module and the organization/application editing interface fail to enforce object-level scope, a low-trust org admin can bypass access controls simply by concatenating/manipulating URLs after login to read and modify resources belonging to other organizations. A public technical writeup/PoC gist exists; it is not listed in CISA KEV and EPSS is low (0.61%, 45th percentile), so exploitation is plausible but not confirmed in the wild. Fixed in v2.63.0.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remote authenticated administrators of any organization within the system to bypass the system's permission verification mechanism by directly concatenating URLs after login
Executive ViewAI
Casdoor, an open-source identity and access management platform, contains an authorization bypass that allows tenant administrators to escalate privileges and access resources belonging to other organizations, compromising multi-tenant isolation. Organizations using Casdoor versions 2.26.0 or earlier in production face risk of unauthorized cross-tenant data exposure and configuration tampering. Since IAM platforms are the root trust boundary for enterprise systems, this vulnerability requires immediate remediation.
Within 24 hours: Identify all Casdoor instances in production and catalog version numbers; restrict admin account activity if possible during assessment. Within 7 days: Apply upgrade to v2.63.0 across all deployments after testing in a staging environment to validate application compatibility. Within 30 days: Conduct forensic audit of admin activity logs from all potentially affected versions (≤2.26.0) to identify unauthorized cross-tenant access; review and re-secure any modified organization or application configurations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB