CVE-2026-15630

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 3.115.1

Description An authorization bypass exists in multi-tenant deployments due to a synchronization failure between the authorization layer and the controller layer. A non-global organization administrator can bypass tenant boundaries to delete, create, or modify resources in other tenants. The issue occurs because the global authorization filter in routers/authzfilter.go uses the id URL query parameter to validate permissions, while downstream controllers, such as controllers/user.go, ignore this parameter and instead use the owner and name fields from the JSON request body to identify the target object. This allows an attacker to authorize an action for their own organization via the id parameter but execute it against a different organization by specifying a different owner in the request body.

Affected API endpoints include:

Recommendations Update to a version later than 3.115.0. Deploy a WAF rule to block requests where the owner field in the JSON body does not match the organization context derived from the authenticated session or the id parameter.