What is the CVSS score of CVE-2025-61524?

CVE-2025-61524 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Suse are affected by CVE-2025-61524?

Casdoor, an open-source identity and access management platform, contains an authorization bypass that allows tenant administrators to escalate privileges and access resources belonging to other…. A patch is available.

How to fix or mitigate CVE-2025-61524?

Within 24 hours: Identify all Casdoor instances in production and catalog version numbers; restrict admin account activity if possible during assessment. Within 7 days: Apply upgrade to v2.63.0 across all deployments after testing in a staging environment to validate application compatibility. Within 30 days: Conduct forensic audit of admin activity logs from all potentially affected versions (≤2.26.0) to identify unauthorized cross-tenant access; review and re-secure any modified organization or application configurations.

Suse CVE-2025-61524

HIGH

Improper Authorization (CWE-285)

2025-10-08 cve@mitre.org

Authentication Bypass Suse

7.2

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 02:46 vuln.today

DescriptionCVE.org

An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remote authenticated administrators of any organization within the system to bypass the system's permission verification mechanism by directly concatenating URLs after login

AnalysisAI

Improper authorization in Casdoor (an open-source Identity and Access Management / SSO platform) versions 2.26.0 and earlier lets a remote authenticated administrator of ANY organization escalate beyond their tenant boundary. Because the permission-verification module and the organization/application editing interface fail to enforce object-level scope, a low-trust org admin can bypass access controls simply by concatenating/manipulating URLs after login to read and modify resources belonging to other organizations. A public technical writeup/PoC gist exists; it is not listed in CISA KEV and EPSS is low (0.61%, 45th percentile), so exploitation is plausible but not confirmed in the wild. Fixed in v2.63.0.