Casdoor CVE-2026-105307

No special conditions beyond network reachability - remote unauthenticated exploitation against Casdoor instances up to 3.161.1 whose API authorization relies on the vulnerable ApiFilter function (AV:N/AC:L/PR:N/UI:N). The attacker must be able to reach the exposed Casdoor API endpoint, so instances behind network segmentation, a reverse proxy enforcing separate auth, or not internet-exposed face reduced risk. Impact is bounded by the reporter's Low confidentiality/integrity/availability ratings and no scope change, suggesting access is limited to specific endpoints rather than full administrative control; no fixed version is published, so mitigation currently depends on access restriction rather than patching.

This is a medium-severity authentication-bypass (CWE-306) in Casdoor's ApiFilter endpoint, rated CVSS 4.0 6.9 by the reporter. The signals are mixed and lean toward moderate rather than urgent priority. In favor of attention: the vector is remote and unauthenticated (AV:N/AC:L/PR:N/UI:N) and exploit maturity is marked E:P, meaning publicly available exploit code exists. Tempering that: all three impact metrics are rated Low (VC:L/VI:L/VA:L) with no subsequent-system impact (SC:N/SI:N/SA:N), so this is not a full IAM takeover as reported. KEV status is NOT present - there is no CISA-confirmed active exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be weighed here; its absence should not be read as low risk. The entire record originates from a single source (VulDB) and the vendor did not respond to disclosure, so there is no independent vendor confirmation of scope, impact, or a fix. Notable tension: a 'missing authentication' flaw on an IAM/SSO product's API endpoint would normally imply high confidentiality/integrity impact, yet the reporter assigned only Low impacts - verify actual impact against the vendor's code and the public PoC, as the Low ratings may understate consequences depending on which endpoints the filter governs.

A remote, unauthenticated attacker sends crafted requests to a Casdoor API endpoint whose authorization is enforced by the flawed ApiFilter logic in routers/authz_filter.go, and the request is processed as if authenticated. Public exploit code is reported to exist (CVSS E:P), lowering the barrier to attempts. Because no user interaction or privileges are required, exploitation can be scripted against any internet-reachable Casdoor instance up to version 3.161.1.