CVE-2025-61524 Casdoor is vulnerable to Improper Authorization
Authenticated administrators can bypass permission checks to modify organizations or applications by manipulating URLs, requiring an upgrade to Casdoor.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-61524?
CVE-2025-61524 is a high-severity authentication bypass vulnerability in n/a, published on 8 Oct 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remote authenticated administrators of any organization within the system to bypass the system's permission verification mechanism by directly concatenating URLs after login
Weakness: CWE-285
Which versions are affected by CVE-2025-61524?
3 open source packages ship an affected version, including github.com/casdoor/casdoor.
| Package | Affected | Fixed in |
|---|---|---|
github.com/casdoor/casdoor Go | All versions | None |
github.com/casdoor/casdoor Go | All versions | 2.63.0 |
github.com/casdoor/casdoor Go | All versions | 2.63.0 |
How do I fix CVE-2025-61524?
Upgrade github.com/casdoor/casdoor to 2.63.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-61524 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-61524 exists.
Sources
Also known as GHSA-5m9m-j5p7-m7f9, GO-2025-4026.