CVE-2026-84423

Received Received - Intake

Authentication Bypass in Casdoor via Upload API

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulDB

Description

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84423

EUVD

EUVD-2026-69726

Affected Vendors & Products

Vendor	Product	Version / Range
casdoor	casdoor	to 4.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects Casdoor versions up to 4.0.0. It involves a missing authentication issue in the upload-resource API due to an unspecified flaw in the controllers/resource.go file. The attack can be executed remotely without requiring user interaction.

Detection Guidance

This vulnerability involves missing authentication in the Casdoor upload-resource API. To detect it, check if unauthenticated requests can access or upload resources via the API endpoint. Monitor logs for unusual activity in controllers/resource.go or API calls to /api/resource without proper authentication. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to upload unauthorized resources or manipulate existing ones without authentication. This may lead to data breaches, unauthorized access, or system compromise depending on the deployed environment.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or modification. GDPR and HIPAA mandate strict access controls and data protection; missing authentication may lead to non-compliance and potential legal consequences.

Mitigation Strategies

Upgrade Casdoor to a version beyond 4.0.0 where the vulnerability is patched. If no patch exists, disable the upload-resource API endpoint or restrict access to trusted users only. Monitor network traffic for unauthorized upload attempts.

Hi! I’m here to help you understand CVE-2026-84423. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70