VulnSocial

CVE-2026-84423General

LOWCVSS 5.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-287CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-02); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-02: 1Mentions · 2026-09-03: 1Technical Details · 2026-09-03: 109-0209-03
Signal classification2 categories
General
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-021
General1
2026-09-031
Disclosure1
Full discourse2 posts
  • Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs
    Disclosure

    CVE-2026-84423 Casdoor Unauthenticated file upload could enable identity spoofing in IdAM and SSO deployments handling OAuth, OIDC and SAML flows Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-09-01/TIER_2_CVE-2026-84423.md #CyberSecurity #IdentitySecurity #VulnerabilityManagement

    Post summary

    CVE-2026-84423 describes a file‑upload flaw in Casdoor that could lead to identity spoofing in IdAM/SSO environments; a detailed analysis is available on GitHub, but no PoC, exploit, or active exploitation reports are mentioned.

    0101083
    61 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-84423 A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such… https://www.cve.org/CVERecord?id=CVE-2026-84423

    Post summary

    The text identifies a new CVE in Casdoor with minimal technical context and no additional details on exploitation or mitigation.

    000201.8K
    58.1K followersView on X

Explore more

Back to dashboard