CVE-2026-5469 Casdoor Webhook URL server-side request forgery

What is CVE-2026-5469?

CVE-2026-5469 is a medium-severity server-side request forgery vulnerability in Casdoor, published on 3 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Weakness: CWE-918

Which versions are affected by CVE-2026-5469?

3 open source packages ship an affected version, including github.com/casdoor/casdoor. It affects 1 product.

Products include Casbin Casdoor.

How do I fix CVE-2026-5469?

No fix published yet.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-5469 being exploited?

There is no known exploitation of CVE-2026-5469 in the wild and no public exploit code.

Other vulnerabilities in Casdoor

• CVE-2022-38638 Casdoor arbitrary file write vulnerability Critical 9.1
• CVE-2024-41657 GHSL-2024-035: Casdoor CORS misconfiguration High 8.1
• CVE-2022-44942 Casdoor arbitrary file deletion vulnerability via uploadFile function High 8.1
• CVE-2024-41264 casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification High 7.5
• CVE-2022-24124 SQL Injection in Casdoor High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p8c7-hjc4-gwf8, GO-2026-5535.