Description

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-01T23:17:21.497Z",
  "pubdate": "2026-09-01T23:17:21.497Z",
  "executiveSummary": "A critical vulnerability has been identified in the Casdoor upload-resource API, specifically within the controllers/resource.go file, affecting all versions up to 4.0.0.\nThe vulnerability is classified as a missing authentication flaw, which allows remote, unauthenticated attackers to interact with the resource upload mechanism.\nThis flaw presents a significant security risk as it enables unauthorized parties to bypass access controls intended to protect file storage endpoints.\nBecause the vulnerability is publicly disclosed and exploitable remotely, the risk of malicious exploitation is elevated.\nThe absence of vendor communication and the deletion of public issue trackers suggest that patch availability or formal acknowledgement for this specific flaw remains uncertain, necessitating immediate defensive measures from affected deployments.",
  "technicalDetails": "The vulnerability resides within the controllers/resource.go component of the Casdoor authentication and identity management system. The root cause is a failure to properly implement authentication checks or access control middleware on the upload-resource API endpoint.\nIn a secure implementation, the controller handling resource uploads should verify the identity and permissions of the requester before processing the request. Due to the missing authentication, the system accepts requests to this endpoint without validating a valid session, token, or administrative privilege.\nThe attack flow proceeds as follows: An attacker identifies the target instance of Casdoor. By targeting the unauthenticated upload-resource API, the attacker can submit arbitrary data or files to the server's storage backend. Because there is no authentication layer, the request is processed by the controller, leading to unauthorized write operations.\nThe attack is remotely exploitable, requiring no prior authentication or administrative privileges. An attacker can use common HTTP client tools to transmit multipart/form-data requests directly to the affected endpoint. Since the API does not enforce session validation, the server treats the request as legitimate, potentially allowing the attacker to store unauthorized files on the infrastructure hosting the Casdoor application.\nThe post-exploitation impact includes unauthorized storage consumption, potential for malicious file uploads, and the risk of directory traversal or arbitrary file write depending on how the application handles the uploaded file names and storage paths. If the server is configured to serve static files from the upload directory, this vulnerability could potentially be chained with other flaws to achieve remote code execution (RCE) if executable files are uploaded to a web-accessible directory.\nThis vulnerability affects Casdoor versions up to 4.0.0. Given the lack of a vendor-provided patch at the time of disclosure, manual intervention by system administrators is required to secure the endpoint against unauthorized access."
}