External risk intelligence

Casdoor Authorization Bypass Allows Cross-Tenant Resource Manipulation

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-15630

This vulnerability affects identity and authorization management within a multi-tenant environment. Such services are commonly deployed as public-facing web applications or API gateways that must be accessible to users across the internet to function as intended.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability allows a standard administrator in one tenant to bypass security controls and affect resources across all tenants. This could enable unauthorized data modification, deletion, or creation within any tenant, impacting the integrity and availability of services. The main concern is confirming relevance and exposure due to the potential for widespread impact.

Admins can access other tenants' data.
Matters for trust and data protection.
Verify if your systems are affected.

Attack Path

How an attacker could exploit the issue

An attacker with administrative privileges in one tenant could exploit a flaw in how the system checks permissions. By manipulating a request, an attacker could trick the system into performing actions, such as deleting or modifying resources, on tenants they should not have access to, potentially impacting data integrity and availability across the entire platform.

Requires admin access in one tenant.
Triggered by a crafted request.
Risk of unauthorized resource modification.

Live Threat

Current exploitation, exposure, and threat context

A non-global administrator in one tenant could potentially affect resources in any other tenant. This may occur when the system fails to properly validate requests, allowing an administrator to perform actions across tenant boundaries by exploiting a discrepancy between how identity is checked and what actions are permitted.

Resources across tenants could be affected.
Actions could bypass tenant isolation.
Unauthorized resource modification or deletion.

Operational Fix

Recommended remediation, mitigation, and detection steps

A critical vulnerability allows non-global administrators to bypass tenant restrictions and manipulate resources across any tenant. This threat requires immediate attention from platform and security teams responsible for identity and access management. The first practical step is to identify all instances of the affected technology, determine their reachability and business criticality, and confirm the accountable owner for each. Remediation planning should then be prioritized based on the identified risks.

Platform and security teams own this.
Verify affected technology and exposure.
Plan targeted remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Casdoor?

Casdoor is an open-source identity and access management (IAM) solution. It provides centralized authentication and authorization services, often used to manage users and permissions across different applications or environments. It supports multi-tenancy, meaning a single installation can serve multiple distinct organizations or user groups while attempting to keep their data and administrative domains separate.

What is the vulnerability in CVE-2026-15630?

This is an authorization bypass flaw, specifically categorized under weaknesses like CWE-269, CWE-639, and CWE-863. It occurs because the software fails to consistently enforce tenant boundaries. When a user performs an action, the system uses one parameter to identify the user but a different parameter from the request body to execute the change, allowing a user to effectively impersonate the authority of another tenant.

How can an attacker trigger this issue?

An attacker must already possess non-global administrative privileges within one specific tenant. They trigger the bug by crafting a request that misaligns the intended target tenant with their own authorized session. It is important to note that this is not a general authentication bypass; the exploit does not trigger if the attacker lacks a valid, authenticated administrative account within the platform.

Why does Halo Surface Signal categorize this as external?

Halo Surface Signal identifies this as an external threat because Casdoor typically functions as a public-facing web application or API gateway. Since it must be accessible across the internet to manage identities for distributed services, the attack vector is network-based, meaning someone from outside your internal network could reach the vulnerable interface.

How should I respond if I use Casdoor?

First, conduct an inventory to identify every instance of Casdoor running in your environment. Evaluate the reachability of these instances to determine if they are exposed to the internet. Determine the business criticality of the data managed by each instance and coordinate with the accountable owners to prioritize your next steps for mitigation.

References

vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.