PT-2026-44423 · Casdoor · Casdoor

David Lie + 4 · CVE-2026-9094 · Published 2026-05-28 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 2.362.1

Description An issue allows cross-organization token exchange. The GetTokenExchangeToken() function in object/token oauth.go validates JWT signatures but fails to verify if the token's user belongs to the same organization as the target application, potentially leading to privilege escalation across organizational boundaries.

Recommendations Update to a version later than 2.362.0. As a temporary workaround, restrict access to the GetTokenExchangeToken() function until the update is applied.

Fix

Improper Privilege Management

Incorrect Authorization

Weakness Enumeration

CWE-269

CWE-863

Related Identifiers

CVE-2026-9094

GHSA-C9W5-QP6M-M395

GO-2026-5953

OPENSUSE-SU-2026:21483-1

Affected Products

Casdoor

References · 1743

• https://osv.dev/vulnerability/GHSA-c9w5-qp6m-m395 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9094 · Security Note
• https://osv.dev/vulnerability/GO-2026-5953 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/casdoor/casdoor/commit/d92b8568686d · Note
• https://github.com/casdoor/casdoor · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note
• https://suse.com/security/cve/CVE-2026-25232 · Note
• https://suse.com/security/cve/CVE-2026-55513 · Note
• https://suse.com/security/cve/CVE-2026-20736 · Note
• https://suse.com/security/cve/CVE-2026-32828 · Note