CVE-2026-15630 CVE-2026-15630
A non-global admin can bypass tenant boundaries to modify resources in other tenants due to authorization logic flaws.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15630?
CVE-2026-15630 is a critical missing authorization vulnerability in Casdoor, published on 23 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).
Which versions are affected by CVE-2026-15630?
How do I fix CVE-2026-15630?
No fix has been published for CVE-2026-15630 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-15630 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-15630 exists.
Sources
Also known as GHSA-jhfj-h4g6-q9h9.