CVE-2026-91998

CRITICAL · 9.9

hype MIXED · 42 hack

Fresh CVE, high severity, but no PoC, KEV, or patch yet; early-stage chatter driven by NVD mirrors.

What: Casdoor ≤4.4.0 authorization bypass in /api/mcp endpoint allows attackers with any app's clientId/clientSecret to gain unrestricted cross-organization user admin access (CVSS 9.9 CRITICAL).

Why it matters: Published today with CVSS 9.9; enables user enumeration, password salt extraction, admin account creation, and deletion across all orgs. Not yet KEV-listed but severity and ease of exploitation (valid credentials only) warrant immediate triage by Casdoor deployments.

Where it's seen: Same-day social amplification on Bluesky with CVE aggregators resharing NVD data; no public PoC confirmed, no vendor patch announcement yet visible, no defender incident reports.

RISK: CRITICAL — CVSS 9.9, cross-org admin compromise, credential-based attack path trivially weaponizable.

Generated by claude-haiku-4-5 from public posts and authoritative metadata. AI can make mistakes — verify against vendor advisories before acting. 9/15/2026, 5:43:12 PM

Description

Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password salts and email addresses, create administrator accounts, modify existing users, and delete them in any organization by supplying legitimate credentials from a single application.

CVSS 3.1 breakdown

Exploitability 3.1 · Impact 6.0

vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Complexity: Low
Privileges required: Low
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Weaknesses

CWE-863

References

Other · 6