Casdoor CVE-2026-5469

The CVSS 5.1 score reflects a moderate risk profile with several limiting factors: the attack requires high privileges (PR:H per vector), meaning only authenticated administrators can exploit this, and impact is confined to low confidentiality and integrity levels with no availability impact. The CVSS vector shows attack vector network (AV:N) and low complexity (AC:L), confirming remote exploitability without user interaction. Exploitation probability (EPSS) is not provided in input data. Critically, no KEV (CISA Known Exploited Vulnerabilities) status is indicated, and no public exploit code has been identified, suggesting minimal real-world exploitation pressure despite theoretical accessibility. Under SSVC decision framework: exploitation status is unconfirmed, attack is not automatable without webhook configuration access, and technical impact is constrained by privilege requirements and limited scope. This is a legitimate but low-priority vulnerability suitable for standard patching cycles rather than emergency response-the combination of high privilege requirement and lack of public exploitation evidence distinguishes this from higher-risk SSRF issues.

An authenticated administrator with high-privilege webhook configuration access modifies a webhook URL to point to an internal service (e.g., http://localhost:8080/admin, http://internal-database:5432). When Casdoor triggers the webhook, the server makes an HTTP request to the attacker-specified internal endpoint, potentially exfiltrating configuration data, querying internal services, or triggering unintended actions on systems that trust local requests. The attack requires legitimate administrator credentials and knowledge of internal network topology but bypasses perimeter security controls because the request originates from the trusted Casdoor server itself.