Authorization Checked One Tenant, Then Changed Another

EVIDENCE — CERT/CC published CVE-2026-15630 on 3 September 2026 for Casdoor, an open-source identity and access-management platform. Its confirmed scope is Casdoor 3.115.0 and earlier. In a multi-tenant deployment, an authenticated administrator of one organization can submit state-changing API requests that pass authorization against an object in that administrator’s own tenant but perform the operation against an object named in another tenant.

THE CHECK AND THE ACTION DISAGREE — Casdoor’s global authorization filter treats the URL query parameter id as the authoritative target. Multiple add and delete controllers instead deserialize owner and name from the JSON body and use those values for the database action. Original researcher Voke Cyber demonstrated the mismatch with a delete-user request: the URL identifies an attacker-owned user while the body identifies a victim-tenant user. The filter approves the first identity; the controller deletes the second. This is authorization-versus-action desynchronization, not an authentication bypass by an anonymous outsider.

IDENTITY CONTROL BECOMES CROSS-TENANT CONTROL — CERT/CC says the reachable administrative effects can include managing users and privileges and disrupting SSO or SAML identity. The original research reports that the same body-only pattern spans roughly 25 add and delete endpoints involving users, permissions, groups, invitations, and certificates. A compromised or malicious organization administrator can therefore attack other tenants and may be able to create backdoor administrators or permissive Casbin rules. The blast radius depends on exposed endpoints and deployment configuration; neither source reports active exploitation in the wild.

A HIGHER VERSION NUMBER IS NOT A FIX CLAIM — CERT/CC reported that it could not coordinate with Casdoor, listed the vendor status as unknown, and knew of no vendor patch when the note was published. Casdoor’s public release page shows versions newer than 3.115.0, including 4.1.0 released on 2 September, but its changelog does not identify CVE-2026-15630 as fixed, and the project’s public security-advisory page showed no published advisory when checked on 4 September. Defenders should not infer remediation from version order alone; wait for an explicit upstream fix or independently verify the request-path correction.

WHAT TO CHECK — Inventory self-hosted and embedded Casdoor instances, their exact builds, tenant counts, exposed add/delete APIs, and every account with IsAdmin=true. Minimize organization administrators, disable workflows or self-signup paths that grant admin rights automatically, require MFA for retained admins, and alert when the tenant in the URL id differs from the owner in the JSON body. Hunt for cross-organization user creation or deletion, new administrators, unexpected Casbin rules—especially wildcard resources or actions—certificate removal, SSO failures, and unexplained drops in tenant user counts. A reverse proxy or WAF can log or reject mismatches, but test in log-only mode first because legitimate Casdoor flows may not always send id consistently. Editorial view: authorization is only real when the object checked is the object changed.