PT-2025-41302 · Casdoor · Casdoor

Devhjz · Publicado 2025-10-08 · Atualizado 2025-11-07 · CVE-2025-61524

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 2.26.0

Description A flaw exists in the permission verification module and organization/application editing interface. This allows remotely authenticated administrators of any organization to circumvent the system's permission checks by manipulating URLs after logging in.

Recommendations Update to version 2.26.0 or later.

Exploit

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2025-61524

GHSA-5M9M-J5P7-M7F9

GO-2025-4026

OPENSUSE-SU-2025:15710-1

Produtos afetados

Casdoor

Referências · 84

• 🔥 https://gist.github.com/DevHjz/e75cea851d48e5f5478ac2a90757851a · Exploit
• https://github.com/casdoor/casdoor · Nota
• https://github.com/casdoor/casdoor/commit/d883db907bb6e0b95737ef8e8b57b7da9078cbdd · Nota
• https://github.com/casdoor/casdoor/releases/tag/v2.63.0 · Nota
• https://suse.com/security/cve/CVE-2025-61688 · Nota
• https://suse.com/security/cve/CVE-2016-11084 · Nota
• https://suse.com/security/cve/CVE-2016-11074 · Nota
• https://suse.com/security/cve/CVE-2025-54293 · Nota
• https://suse.com/security/cve/CVE-2025-11579 · Nota
• https://osv.dev/vulnerability/GHSA-5m9m-j5p7-m7f9 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2025-4026 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-11067 · Nota
• https://suse.com/security/cve/CVE-2025-58073 · Nota
• https://suse.com/security/cve/CVE-2025-58356 · Nota
• https://suse.com/security/cve/CVE-2017-18872 · Nota