Casdoor CVE-2026-5469

Q: What is the CVSS score of CVE-2026-5469?

CVE-2026-5469 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18658 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-03 VulDB

GHSA-p8c7-hjc4-gwf8

SSRF Casdoor

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 03, 2026 - 15:00 euvd

EUVD-2026-18658

Analysis Generated

Apr 03, 2026 - 15:00 vuln.today

CVE Published

Apr 03, 2026 - 14:30 nvd

MEDIUM 5.1

DescriptionCVE.org

A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery in Casdoor 2.356.0 webhook URL handler allows authenticated remote attackers with high privileges to trigger SSRF attacks through webhook URL manipulation, enabling potential access to internal network resources. No public exploit code or active exploitation has been identified; CVSS 5.1 reflects limited confidentiality and integrity impact despite remote network accessibility.

Technical ContextAI

Casdoor's webhook URL handler component fails to properly validate or restrict the destination URLs that can be specified for webhook callbacks. This enables server-side request forgery (CWE-918), a class of vulnerability where an attacker manipulates server-side HTTP requests to access internal resources, bypassing network segmentation and access controls. The vulnerability resides in the webhook configuration mechanism, where user-supplied URLs are processed server-side without adequate sanitization. The affected product is identified via CPE as Casdoor (cpe:2.3:a:n/a:casdoor), with version 2.356.0 explicitly confirmed vulnerable. SSRF vulnerabilities in webhook handlers are particularly dangerous because webhooks inherently require outbound network requests, making legitimate and malicious traffic difficult to distinguish.

RemediationAI

Apply a patched version of Casdoor released after version 2.356.0 once vendor fixes become available. As a temporary mitigation, restrict webhook URL configuration to authenticated high-privilege accounts only, implement network-level restrictions on outbound connections from the Casdoor server to internal IP ranges (RFC 1918 addresses, localhost, 169.254.x.x), and use allowlist-based URL validation to restrict webhook destinations to approved external hosts. Monitor webhook configuration changes and outbound connections for anomalous behavior. Note: the vendor did not respond to early disclosure notifications, so updates may require monitoring Casdoor's public repository or release announcements directly.