Casbin is a modestly represented access-control and authorization library whose vulnerability profile centers on its Casdoor identity and access management product, which operates as a web-facing authentication and authorization gateway deployed across diverse application ecosystems. The vendor's disclosures cluster around input-handling and request-validation weakness classes—including path traversal, cross-site scripting, cross-site request forgery, and improper certificate validation—that are characteristic of web application entry points, and frequently acquire public exploit code. Live severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Casbin over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-24124HIGH The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations. | Jan 29, 2022 | 7.5 | 75 | NO | YES |
CVE-2026-6815MEDIUM An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker with administrative p | May 11, 2026 | 5.9 | 35 | NO | YES |
CVE-2023-34927MEDIUM Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily chang | Jun 22, 2023 | 6.5 | 29 | NO | YES |
CVE-2022-38638CRITICAL Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource. | Sep 9, 2022 | 9.1 | 28 | NO | NO |
CVE-2022-44942HIGH Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function. | Dec 7, 2022 | 8.1 | 26 | NO | NO |
CVE-2024-41657HIGH Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFil | Aug 20, 2024 | 8.8 | 25 | NO | NO |
CVE-2026-5469HIGH A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side re | Apr 3, 2026 | 7.2 | 24 | NO | NO |
CVE-2026-5467MEDIUM A vulnerability was identified in Casdoor 2.356.0. Affected by this issue is some unknown functionality of the component OAuth Authorization Request Handler. Such manipulation of t | Apr 3, 2026 | 6.1 | 22 | NO | NO |
CVE-2024-41264HIGH An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method. | Aug 1, 2024 | 7.5 | 21 | NO | NO |
CVE-2026-5468MEDIUM A security flaw has been discovered in Casdoor 2.356.0. This affects the function dangerouslySetInnerHTML. Performing a manipulation of the argument formCss/formCssMobile/formSideH | Apr 3, 2026 | 5.4 | 20 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Casbin.
Media articles that mention a CVE ID that affects a product developed by Casbin — matched by CVE ID, not by vendor name.