PT-2025-18796 · Casdoor · Casdoor

Krav · Published 2025-05-02 · Updated 2026-01-14 · CVE-2025-4210

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Casdoor versions up to 1.811.0

Description A critical issue was found in the SCIM User Creation Endpoint, specifically affecting the HandleScim function of the controllers/scim.go file. This issue leads to authorization bypass and can be initiated remotely.

Recommendations For versions up to 1.811.0, upgrade to version 1.812.0 to address this issue.

Fix

Improper Authorization

IDOR

Weakness Enumeration

CWE-285

CWE-639

Related Identifiers

CVE-2025-4210

GHSA-8W8F-H4CM-C4PG

GO-2025-3661

OPENSUSE-SU-2025:15059-1

Affected Products

Casdoor

References · 30

• https://github.com/casdoor/casdoor/releases/tag/v1.812.0 · Patch
• https://github.com/casdoor/casdoor/commit/3d12ac8dc2282369296c3386815c00a06c6a92fe · Patch
• https://osv.dev/vulnerability/GHSA-8w8f-h4cm-c4pg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-4210 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15059-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3661 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4210 · Security Note
• https://github.com/casdoor/casdoor · Note
• https://suse.com/security/cve/CVE-2025-46599 · Note
• https://vuldb.com/?ctiid.307180 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/HNV7O7SNYYY4AFS5HKAPLITKK3B57LE7 · Note
• https://suse.com/security/cve/CVE-2023-32198 · Note
• https://twitter.com/pdnuclei_bot/status/2011392891718136248 · Twitter Post
• https://t.me/cvedetector/24348 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1918352187278643324 · Twitter Post