Casdoor CVE-2026-84423

No special conditions required - any attacker with HTTP or HTTPS network access to the Casdoor API port can reach the /api/upload-resource endpoint and upload arbitrary files without credentials (AV:N, PR:N, UI:N against default deployments through version 4.0.0). The public PoC (labeled 'Finding 1') demonstrates exploitation of the default configuration with no prerequisites beyond network reachability. Impact severity beyond the conservative CVSS L/L/L depends on deployment storage configuration: if uploaded files land in a web-executable directory, code execution escalates. Exploitation is limited to Casdoor instances exposed to untrusted networks - deployments strictly behind VPN or private-only network boundaries reduce reachability but are not immune if internal threat actors or pivot scenarios apply.

The CVSS 4.0 vector confirms fully remote, zero-prerequisite exploitation - no authentication, no special configuration, no user interaction required. The E:P modifier confirms a public PoC exists, elevating near-term exploitation probability. The provided impact scores (VC:L/VI:L/VA:L) appear conservative for an unauthenticated arbitrary file upload on an IAM/SSO platform: if uploaded files are stored in a web-accessible directory, the integrity impact could escalate to High via web shell deployment or server-side code execution; if files are served back to authenticated users, stored XSS via malicious SVG or HTML is a realistic secondary impact. The vendor's refusal to engage - deleting the GitHub issue and ignoring email contact - raises high confidence that no patch exists as of this analysis. No CISA KEV listing is present; EPSS data was not provided, but PoC availability on a zero-auth remote endpoint substantially increases the probability of opportunistic exploitation. The conservative CVSS rating and vendor silence should not be interpreted as low urgency.

An unauthenticated attacker sends a crafted multipart HTTP POST request directly to the /api/upload-resource endpoint on an internet-exposed Casdoor instance. The server accepts and stores the attacker-controlled file without any authentication check. If the storage path is web-accessible and the server executes certain file types, the attacker achieves code execution; alternatively, a malicious SVG or HTML file stored and later served to authenticated users triggers stored XSS against privileged sessions in this IAM platform.