PT-2025-41302 · Casdoor · Casdoor

Devhjz · Published 2025-10-08 · Updated 2025-11-07 · CVE-2025-61524

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 2.26.0

Description A flaw exists in the permission verification module and organization/application editing interface. This allows remotely authenticated administrators of any organization to circumvent the system's permission checks by manipulating URLs after logging in.

Recommendations Update to version 2.26.0 or later.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-61524

GHSA-5M9M-J5P7-M7F9

GO-2025-4026

OPENSUSE-SU-2025:15710-1

Affected Products

Casdoor

References · 84

• 🔥 https://gist.github.com/DevHjz/e75cea851d48e5f5478ac2a90757851a · Exploit
• https://osv.dev/vulnerability/GHSA-5m9m-j5p7-m7f9 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4026 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61524 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61524 · Vendor Advisory
• https://github.com/casdoor/casdoor · Note
• https://github.com/casdoor/casdoor/commit/d883db907bb6e0b95737ef8e8b57b7da9078cbdd · Note
• https://github.com/casdoor/casdoor/releases/tag/v2.63.0 · Note
• https://suse.com/security/cve/CVE-2025-61688 · Note
• https://suse.com/security/cve/CVE-2016-11084 · Note
• https://suse.com/security/cve/CVE-2016-11074 · Note
• https://suse.com/security/cve/CVE-2025-54293 · Note
• https://suse.com/security/cve/CVE-2025-11579 · Note
• https://suse.com/security/cve/CVE-2016-11067 · Note