CVE-2025-61524
BaseFortify
Publication date: 2025-10-08
Last updated on: 2025-10-14
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| casdoor | casdoor | 2.62.0 |
| casdoor | casdoor | 2.63.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Casdoor versions before 2.26.0, where a flaw in the permission verification module and the organization/application editing interface allows remote authenticated administrators of any organization within the system to bypass the system's permission verification mechanism by directly concatenating URLs after login.
How can this vulnerability impact me? :
The vulnerability allows remote authenticated administrators to bypass permission checks, potentially enabling them to access or modify resources or settings they should not have permission to, which could lead to unauthorized actions within the system.