VulnSocial

CVE-2026-91998Disclosure

LOWCVSS 9.4 · CRITICAL

Exploit discussion active in current signal (3 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password salts and email addresses, create administrator accounts, modify existing users, and delete them in any organization by supplying legitimate credentials from a single application.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

  • Public PoC is present in monitored signal
  • 3 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • 3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-09-18: 3PoC Mentioned / Linked · 2026-09-18: 1Technical Details · 2026-09-18: 309-18
Signal classification2 categories
Disclosure
266.7%
PoC
133.3%
Referenced assets1 URL
Full discourse3 posts
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    🔴 Casdoor'da CVE-2026-91998 (CVSS 9.4) numaralı kritik yetkilendirme atlatma açığı tespit edildi! 4.4.0 ve öncesini etkileyen açık, geçerli bir uygulamaya ait clientId + clientSecret bilgilerine sahip saldırganların /api/mcp üzerinden organizasyonlar arasındaki yetki sınırını aşmasına izin veriyor. Saldırganlar diğer organizasyonlardaki kullanıcıları listeleyebilir, değiştirebilir, silebilir ve yeni yönetici hesapları oluşturabilir. CVE: CVE-2026-91998 CVSS: 9.4 (Critical) Etkilenen: Casdoor ≤ 4.4.0 Tür: Authorization Bypass Yama: Resmi Casdoor advisory'sinde doğrulanmış sabit sürüm henüz belirtilmiyor.

    Post summary

    The tweet announces a critical authorization bypass vulnerability (CVE-2026-91998) in Casdoor ≤4.4.0, detailing the attack mechanism and severe impact, while noting that no official patch version is currently available.

    00020317
    2.5K followersView on X
  • CCB Alert@CCBalert
    PoC

    Warning: Critical authorization bypass in #Casdoor. #CVE-2026-91998 CVSS: 9.4. Successful exploitation could allow an attacker to gain unrestricted access to user administration across all organizations. A PoC exploit increases the likelihood of exploitation. #Patch #Patch #Patch

    Post summary

    The post warns of a critical Casdoor authorization bypass vulnerability with a high CVSS score and impact, and explicitly mentions the existence of a PoC exploit. It does not report active exploitation, name a specific exploit tool, or provide a concrete patch or workaround.

    00001317
    7.3K followersView on X
  • Cybersecurity News DE@cybsecuritynews
    Disclosure

    #schwachstellen Casdoor: Kritische Schwachstelle erlaubt Vollzugriff auf Benutzerverwaltung über Organisationsgrenzen hinweg #casdoor #cve202691998 #nvd https://cybersecurity-news.de/cve-2026-91998-casdoor-autorisierungsfehler-benutzerverwaltung

    Post summary

    A German-language tweet announcing CVE-2026-91998 for Casdoor as a critical authorization vulnerability enabling cross-organization user management access. It provides basic technical details and links to a news article but contains no PoC, exploit tool, active exploitation claims, or patch information.

    0000045
    13 followersView on X

Explore more

Back to dashboard