Casdoor EUVD-2026-77710

Exploitation requires an authenticated organization-administrator account on the target Casdoor instance (PR:L) - it is not reachable by anonymous/unauthenticated users. Given that role, the flaw affects default configurations: the /api/get-certs and /api/get-cert endpoints return the instance-wide built-in certificate's private key without masking, so no special feature toggle is needed. The critical limiting factor is the org-admin privilege requirement; the critical amplifying factor is that this is a single shared signing key for the whole instance, so any one org admin can forge tokens for users in any organization, including global administrators (cross-tenant scope change). Risk is highest in multi-tenant deployments where organization-admin accounts are self-service or not fully trusted.

This is a genuinely high-severity issue, though not one of the widest-blast-radius CVEs. The signals are internally consistent: CVSS 4.0 base 9.3 (AV:N/AC:L/PR:L/UI:N with a scope change SC:H/SI:H) aligns with SSVC (Exploitation: poc, Automatable: yes, Technical Impact: total) and with a publicly available exploit write-up. The one apparent tension is EPSS, which is very low at 0.21% (11th percentile) despite a public PoC and 'total' technical impact - this reflects that exploitation is not remote-unauthenticated (an attacker must already hold organization-administrator privileges) rather than any weakness in the technical impact. There is no CISA KEV listing, so this is 'publicly available exploit code exists,' NOT confirmed active exploitation. The core weakness (CWE-863 incorrect authorization exposing the instance-wide JWT signing private key) is severe because it collapses tenant isolation entirely: a low-trust org admin can escalate to forging tokens as a global administrator across all organizations. Net: a real priority for any multi-tenant Casdoor deployment where organization-admin accounts are not fully trusted, but the PR:L prerequisite meaningfully limits opportunistic mass exploitation, consistent with the low EPSS.

An attacker who controls (or registers/compromises) an organization-administrator account in a shared Casdoor instance calls /api/get-certs or /api/get-cert and receives the unmasked built-in certificate private key. They use that key to sign forged JWTs impersonating any user - including a global administrator - gaining full cross-organization control. A public exploit write-up detailing this exact technique is available (VulnCheck advisory / geo-chen OSS finding-3).