Cyber & AI intelligence
Wasteland.
Briefs indexed2615
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-91998 2026-09-15

CVE-2026-91998: Casdoor /api/mcp Authorization Bypass Hands Any App Full Cross-Org User Admin

"A critical authorization bypass in Casdoor through version 4.4.0 lets anyone holding a single application's clientId and clientSecret administer users across every organization in the deployment."

A critical authorization bypass in Casdoor through version 4.4.0 lets anyone holding a single application's clientId and clientSecret administer users across every organization in the deployment.

What Is It

CVE-2026-91998 is an authorization bypass (CWE-863, Incorrect Authorization) in the /api/mcp endpoint of Casdoor, an open-source identity and access management platform. The endpoint accepts legitimate application credentials, a clientId and clientSecret pair from any registered application, and then fails to scope the resulting access to that application's organization. The result is unrestricted user administration across all organizations.

The flaw carries a CVSS 3.1 base score of 9.9 (CRITICAL, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and a CVSS 4.0 score of 9.4 (CRITICAL). The scope change in the 3.1 vector reflects exactly what makes this severe: credentials issued for one security boundary grant control over all of them. It was disclosed via VulnCheck and published 2026-09-15.

Why It Matters

Casdoor is an identity provider; compromise here is compromise of everything sitting behind it. Per the advisory, an attacker with one application's credentials can:

Creating an admin account in an arbitrary organization is a direct path to tenant takeover, and it requires no user interaction and no elevated starting privileges beyond credentials that many deployments distribute freely to internal or third-party applications. Attack complexity is rated LOW.

Exploitation status: this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog at time of writing, and no exploit maturity is defined in the CVSS 4.0 vector. There is no confirmed active exploitation to report.

What's Vulnerable

Patch Status

The supplied NVD record lists no fixed version and no vendor patch reference, and the CVE remains in Received status. No required-action or remediation deadline is specified. Until a fix is confirmed, operators should treat /api/mcp as an exposed administrative surface and restrict network access to it.

Sources