CVE-2026-91998

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 4.4.1

Description An authorization bypass exists in the '/api/mcp' endpoint. Attackers possessing a valid clientId and clientSecret from any single application can gain unrestricted access to user administration across all organizations. This allows for the enumeration of user records, including email addresses and password salts, as well as the ability to create administrator accounts, modify users, or delete them.

Recommendations Update Casdoor to version 4.4.1 or later. As a temporary mitigation, restrict access to the '/api/mcp' endpoint.