Authorization Bypass in Casdoor via /api/mcp Endpoint

Executive Summary

CVE-2026-91998 is an authorization bypass vulnerability in Casdoor through version 4.4.0. It allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password salts and email addresses, create administrator accounts, modify existing users, and delete them in any organization by supplying legitimate credentials from a single application.

Useful 0 Not Useful 0

Detection Guidance

Check Casdoor logs for unauthorized access to /api/mcp endpoint. Monitor for unusual user creation, modification, or deletion across organizations. Inspect network traffic for requests containing clientId and clientSecret parameters targeting /api/mcp.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to fully control user accounts across all organizations in a Casdoor instance. They can create backdoor admin accounts, steal sensitive user data like password salts and emails, modify or delete users, and potentially escalate privileges. This compromises the integrity and confidentiality of the entire identity management system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability severely impacts compliance with GDPR and HIPAA by enabling unauthorized access to sensitive personal data. GDPR requires strict access controls and data protection measures, while HIPAA mandates safeguards for protected health information. The flaw allows attackers to exfiltrate, modify, or delete such data, leading to potential violations and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Casdoor to a version beyond 4.4.0 immediately. Disable or restrict access to the /api/mcp endpoint via firewall or network policies. Rotate all clientId and clientSecret credentials for applications. Review and remove unauthorized administrator accounts created through this vulnerability.

Useful 0 Not Useful 0